{ "@context": "https://openvex.dev/ns/v0.2.0", "author": "https://tuxcare.com", "role": "Document Creator", "timestamp": "2026-10-30T11:57:38.726923+00:00", "version": 1, "statements": [ { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@23.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@23.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 23.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@23.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@23.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 23.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 24.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 24.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10170 is fixed in version 3.7.1.post2+tuxcare of anyio.", "vulnerability": { "name": "AIKIDO-2025-10170" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-63374 is fixed in version 3.7.1.post2+tuxcare of anyio.", "vulnerability": { "name": "CVE-2026-63374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64847 is fixed in version 3.7.1.post2+tuxcare of anyio.", "vulnerability": { "name": "CVE-2026-64847" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/piexif@1.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/piexif@1.1.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability SNYK-PYTHON-PIEXIF-2312874 is fixed in version 1.1.3.post1+tuxcare of piexif.", "vulnerability": { "name": "SNYK-PYTHON-PIEXIF-2312874" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-32681 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-32681" }, "action_statement": "Vulnerability CVE-2023-32681 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.30.0.post2+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.30.0.post2+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 24.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 24.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/redis@4.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/redis@4.5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28858 is fixed in version 4.5.1.post1+tuxcare of redis.", "vulnerability": { "name": "CVE-2023-28858" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/redis@4.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/redis@4.5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28859 is fixed in version 4.5.1.post1+tuxcare of redis.", "vulnerability": { "name": "CVE-2023-28859" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 affects version 20.0.4.post2+tuxcare of gunicorn, and is fixed in 20.0.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-1135" }, "action_statement": "Vulnerability CVE-2024-1135 affects version 20.0.4.post2+tuxcare of gunicorn, and is fixed in 20.0.4.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 20.0.4.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-32681 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-32681" }, "action_statement": "Vulnerability CVE-2023-32681 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-25645" }, "action_statement": "Vulnerability CVE-2026-25645 affects version 2.30.0.post1+tuxcare of requests, and is fixed in 2.30.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/websockets@8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/websockets@8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33880 is fixed in version 8.1.post1+tuxcare of websockets.", "vulnerability": { "name": "CVE-2021-33880" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10318 is fixed in version 2.14.5.post3+tuxcare of fastmcp.", "vulnerability": { "name": "AIKIDO-2026-10318" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64340 is fixed in version 2.14.5.post3+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2025-64340" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27124 is fixed in version 2.14.5.post3+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-27124" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32871 is fixed in version 2.14.5.post3+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-32871" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 3.0.0.post2+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 3.0.0.post2+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mysql-connector-python@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mysql-connector-python@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-21272 is fixed in version 8.4.0.post1+tuxcare of mysql-connector-python.", "vulnerability": { "name": "CVE-2024-21272" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64439 is fixed in version 2.1.2.post2+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2025-64439" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27794 is fixed in version 2.1.2.post2+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2026-27794" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48775 affects version 2.1.2.post2+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48775" }, "action_statement": "Vulnerability CVE-2026-48775 affects version 2.1.2.post2+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10318 is fixed in version 2.14.5.post2+tuxcare of fastmcp.", "vulnerability": { "name": "AIKIDO-2026-10318" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64340 affects version 2.14.5.post2+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64340" }, "action_statement": "Vulnerability CVE-2025-64340 affects version 2.14.5.post2+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27124 affects version 2.14.5.post2+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27124" }, "action_statement": "Vulnerability CVE-2026-27124 affects version 2.14.5.post2+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32871 is fixed in version 2.14.5.post2+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-32871" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 20.1.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10742 affects version 20.1.0.post1+tuxcare of gunicorn, and is fixed in 20.1.0.post3+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10742" }, "action_statement": "Vulnerability AIKIDO-2026-10742 affects version 20.1.0.post1+tuxcare of gunicorn, and is fixed in 20.1.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 20.1.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 20.1.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7923 affects version 20.1.0.post1+tuxcare of gunicorn, and is fixed in 20.1.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-7923" }, "action_statement": "Vulnerability CVE-2024-7923 affects version 20.1.0.post1+tuxcare of gunicorn, and is fixed in 20.1.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10318 is fixed in version 2.14.5.post1+tuxcare of fastmcp.", "vulnerability": { "name": "AIKIDO-2026-10318" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64340 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64340" }, "action_statement": "Vulnerability CVE-2025-64340 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27124 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27124" }, "action_statement": "Vulnerability CVE-2026-27124 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32871 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-32871" }, "action_statement": "Vulnerability CVE-2026-32871 affects version 2.14.5.post1+tuxcare of fastmcp, and is fixed in 2.14.5.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-32681 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-32681" }, "action_statement": "Vulnerability CVE-2023-32681 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.25.1.post2+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.25.1.post2+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27454 is fixed in version 3.8.5.post3+tuxcare of orjson.", "vulnerability": { "name": "CVE-2024-27454" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67221 is fixed in version 3.8.5.post3+tuxcare of orjson.", "vulnerability": { "name": "CVE-2025-67221" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 20.1.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10742 is fixed in version 20.1.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2026-10742" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 20.1.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 20.1.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7923 is fixed in version 20.1.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-7923" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1681 is fixed in version 3.0.10.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-1681" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6221 does not affect version 3.0.10.post1+tuxcare of flask-cors. flask-cors 3.0.10 never sets Access-Control-Allow-Private-Network. The header was introduced upstream in 24070be on 2022-06-15, after 3.0.10 (May 2021), and that commit is not an ancestor of tuxcare-current/3.0.10; grep for private_network in flask_cors/ is empty. Verified by execution: a preflight carrying Access-Control-Request-Private-Network: true returns only Access-Control-Allow-Origin and Access-Control-Allow-Methods. The upstream fix 7ae310c only makes that existing header configurable, so there is nothing to backport. PYELS-158.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-6221" }, "impact_statement": "flask-cors 3.0.10 never sets Access-Control-Allow-Private-Network. The header was introduced upstream in 24070be on 2022-06-15, after 3.0.10 (May 2021), and that commit is not an ancestor of tuxcare-current/3.0.10; grep for private_network in flask_cors/ is empty. Verified by execution: a preflight carrying Access-Control-Request-Private-Network: true returns only Access-Control-Allow-Origin and Access-Control-Allow-Methods. The upstream fix 7ae310c only makes that existing header configurable, so there is nothing to backport. PYELS-158." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6839 is fixed in version 3.0.10.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6844 is fixed in version 3.0.10.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6844" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@3.0.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 3.0.10.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6866" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post1+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-53981" }, "action_statement": "Vulnerability CVE-2024-53981 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-40347" }, "action_statement": "Vulnerability CVE-2026-40347 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42561" }, "action_statement": "Vulnerability CVE-2026-42561 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53537" }, "action_statement": "Vulnerability CVE-2026-53537 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53538" }, "action_statement": "Vulnerability CVE-2026-53538 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-53540" }, "action_statement": "Vulnerability CVE-2026-53540 affects version 0.0.6.post1+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post2+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post2+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-40347" }, "action_statement": "Vulnerability CVE-2026-40347 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42561" }, "action_statement": "Vulnerability CVE-2026-42561 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53537" }, "action_statement": "Vulnerability CVE-2026-53537 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53538" }, "action_statement": "Vulnerability CVE-2026-53538 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-53540" }, "action_statement": "Vulnerability CVE-2026-53540 affects version 0.0.6.post2+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 21.2.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 21.2.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 21.2.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7923 affects version 21.2.0.post2+tuxcare of gunicorn, and is fixed in 21.2.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-7923" }, "action_statement": "Vulnerability CVE-2024-7923 affects version 21.2.0.post2+tuxcare of gunicorn, and is fixed in 21.2.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2025-10170 is fixed in version 3.7.1.post1+tuxcare of anyio.", "vulnerability": { "name": "AIKIDO-2025-10170" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-63374 affects version 3.7.1.post1+tuxcare of anyio, and is fixed in 3.7.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-63374" }, "action_statement": "Vulnerability CVE-2026-63374 affects version 3.7.1.post1+tuxcare of anyio, and is fixed in 3.7.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/anyio@3.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/anyio@3.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64847 affects version 3.7.1.post1+tuxcare of anyio, and is fixed in 3.7.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-64847" }, "action_statement": "Vulnerability CVE-2026-64847 affects version 3.7.1.post1+tuxcare of anyio, and is fixed in 3.7.1.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64439 is fixed in version 2.1.2.post3+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2025-64439" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27794 is fixed in version 2.1.2.post3+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2026-27794" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48775 is fixed in version 2.1.2.post3+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2026-48775" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20916 is fixed in version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2019-20916" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3572 is fixed in version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2021-3572" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5752 is fixed in version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2023-5752" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-8869 is fixed in version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2025-8869" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13346 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-13346" }, "action_statement": "Vulnerability CVE-2026-13346 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1703 affects version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-1703" }, "action_statement": "Vulnerability CVE-2026-1703 affects version 9.0.0.post2+tuxcare of pip." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3219 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-3219" }, "action_statement": "Vulnerability CVE-2026-3219 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6357 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6357" }, "action_statement": "Vulnerability CVE-2026-6357 affects version 9.0.0.post2+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8643 is fixed in version 9.0.0.post2+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-8643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20916 is fixed in version 9.0.post1+tuxcare of pip.", "vulnerability": { "name": "CVE-2019-20916" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3572 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2021-3572" }, "action_statement": "Vulnerability CVE-2021-3572 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5752 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-5752" }, "action_statement": "Vulnerability CVE-2023-5752 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-8869 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-8869" }, "action_statement": "Vulnerability CVE-2025-8869 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13346 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-13346" }, "action_statement": "Vulnerability CVE-2026-13346 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1703 affects version 9.0.post1+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-1703" }, "action_statement": "Vulnerability CVE-2026-1703 affects version 9.0.post1+tuxcare of pip." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3219 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-3219" }, "action_statement": "Vulnerability CVE-2026-3219 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6357 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6357" }, "action_statement": "Vulnerability CVE-2026-6357 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8643 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-8643" }, "action_statement": "Vulnerability CVE-2026-8643 affects version 9.0.post1+tuxcare of pip, and is fixed in 9.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 affects version 20.0.4.post1+tuxcare of gunicorn, and is fixed in 20.0.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-1135" }, "action_statement": "Vulnerability CVE-2024-1135 affects version 20.0.4.post1+tuxcare of gunicorn, and is fixed in 20.0.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 affects version 20.0.4.post1+tuxcare of gunicorn, and is fixed in 20.0.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-6827" }, "action_statement": "Vulnerability CVE-2024-6827 affects version 20.0.4.post1+tuxcare of gunicorn, and is fixed in 20.0.4.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-1010083 is fixed in version 0.12.5.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 affects version 0.12.5.post1+tuxcare of flask, and is fixed in 0.12.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-30861" }, "action_statement": "Vulnerability CVE-2023-30861 affects version 0.12.5.post1+tuxcare of flask, and is fixed in 0.12.5.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 affects version 0.12.5.post1+tuxcare of flask, and is fixed in 0.12.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-27205" }, "action_statement": "Vulnerability CVE-2026-27205 affects version 0.12.5.post1+tuxcare of flask, and is fixed in 0.12.5.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 3.0.0.post1+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44405 affects version 3.0.0.post1+tuxcare of paramiko, and is fixed in 3.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-44405" }, "action_statement": "Vulnerability CVE-2026-44405 affects version 3.0.0.post1+tuxcare of paramiko, and is fixed in 3.0.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.25.1.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.25.1.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.25.1.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.25.1.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/celery@v5.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/celery@v5.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-23727 is fixed in version v5.1.2.post1+tuxcare of celery.", "vulnerability": { "name": "CVE-2021-23727" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/uvicorn@0.11.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/uvicorn@0.11.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-7694 is fixed in version 0.11.6.post2+tuxcare of uvicorn.", "vulnerability": { "name": "CVE-2020-7694" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/uvicorn@0.11.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/uvicorn@0.11.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-7695 is fixed in version 0.11.6.post2+tuxcare of uvicorn.", "vulnerability": { "name": "CVE-2020-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/waitress@2.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/waitress@2.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49768 is fixed in version 2.1.2.post1+tuxcare of waitress.", "vulnerability": { "name": "CVE-2024-49768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/waitress@2.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/waitress@2.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49769 affects version 2.1.2.post1+tuxcare of waitress, and is fixed in 2.1.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-49769" }, "action_statement": "Vulnerability CVE-2024-49769 affects version 2.1.2.post1+tuxcare of waitress, and is fixed in 2.1.2.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/lxml@5.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@5.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-2309 does not affect version 5.4.0.post1+tuxcare of lxml. already_fixed \u2014 all patch commits already exist in target branch", "vulnerability": { "name": "CVE-2022-2309" }, "impact_statement": "already_fixed \u2014 all patch commits already exist in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lxml@5.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@5.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41066 is fixed in version 5.4.0.post1+tuxcare of lxml.", "vulnerability": { "name": "CVE-2026-41066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/statsmodels@0.14.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/statsmodels@0.14.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10275 is fixed in version 0.14.5.post1+tuxcare of statsmodels.", "vulnerability": { "name": "AIKIDO-2024-10275" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post4+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post4+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 is fixed in version 0.0.6.post4+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-40347" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42561" }, "action_statement": "Vulnerability CVE-2026-42561 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53537" }, "action_statement": "Vulnerability CVE-2026-53537 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53538" }, "action_statement": "Vulnerability CVE-2026-53538 affects version 0.0.6.post4+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 is fixed in version 0.0.6.post4+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53540" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 20.0.4.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.0.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.0.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 20.0.4.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 21.2.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 21.2.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 21.2.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@21.2.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7923 is fixed in version 21.2.0.post3+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-7923" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 20.1.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10742 affects version 20.1.0.post2+tuxcare of gunicorn, and is fixed in 20.1.0.post3+tuxcare.", "vulnerability": { "name": "AIKIDO-2026-10742" }, "action_statement": "Vulnerability AIKIDO-2026-10742 affects version 20.1.0.post2+tuxcare of gunicorn, and is fixed in 20.1.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1135 is fixed in version 20.1.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 20.1.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@20.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-7923 is fixed in version 20.1.0.post2+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-7923" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/statsmodels@0.14.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/statsmodels@0.14.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10275 is fixed in version 0.14.4.post1+tuxcare of statsmodels.", "vulnerability": { "name": "AIKIDO-2024-10275" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@25.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@25.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 25.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@25.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@25.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 25.3.0.post1+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/celery@4.4.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/celery@4.4.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-23727 is fixed in version 4.4.7.post1+tuxcare of celery.", "vulnerability": { "name": "CVE-2021-23727" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10318 is fixed in version 2.14.7.post1+tuxcare of fastmcp.", "vulnerability": { "name": "AIKIDO-2026-10318" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64340 affects version 2.14.7.post1+tuxcare of fastmcp, and is fixed in 2.14.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64340" }, "action_statement": "Vulnerability CVE-2025-64340 affects version 2.14.7.post1+tuxcare of fastmcp, and is fixed in 2.14.7.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27124 is fixed in version 2.14.7.post1+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-27124" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32871 is fixed in version 2.14.7.post1+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-32871" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post6+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post6+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-40347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-42561" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53537" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53538" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 is fixed in version 0.0.6.post6+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53540" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jaraco-context@5.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jaraco-context@5.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-23949 is fixed in version 5.3.0.post1+tuxcare of jaraco-context.", "vulnerability": { "name": "CVE-2026-23949" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/waitress@2.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/waitress@2.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49768 is fixed in version 2.1.2.post2+tuxcare of waitress.", "vulnerability": { "name": "CVE-2024-49768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/waitress@2.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/waitress@2.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49769 is fixed in version 2.1.2.post2+tuxcare of waitress.", "vulnerability": { "name": "CVE-2024-49769" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post3+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post3+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 is fixed in version 0.0.6.post3+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-40347" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42561" }, "action_statement": "Vulnerability CVE-2026-42561 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53537" }, "action_statement": "Vulnerability CVE-2026-53537 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53538" }, "action_statement": "Vulnerability CVE-2026-53538 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-53540" }, "action_statement": "Vulnerability CVE-2026-53540 affects version 0.0.6.post3+tuxcare of python-multipart, and is fixed in 0.0.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/google-cloud-storage@2.19.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/google-cloud-storage@2.19.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10425 is fixed in version 2.19.0.post2+tuxcare of google-cloud-storage.", "vulnerability": { "name": "AIKIDO-2026-10425" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22195 is fixed in version 3.0.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-22195" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34064 affects version 3.0.3.post1+tuxcare of jinja2, and is fixed in 3.0.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-34064" }, "action_statement": "Vulnerability CVE-2024-34064 affects version 3.0.3.post1+tuxcare of jinja2, and is fixed in 3.0.3.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56201 is fixed in version 3.0.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56326 is fixed in version 3.0.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56326" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27516 affects version 3.0.3.post1+tuxcare of jinja2, and is fixed in 3.0.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-27516" }, "action_statement": "Vulnerability CVE-2025-27516 affects version 3.0.3.post1+tuxcare of jinja2, and is fixed in 3.0.3.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/uvicorn@0.11.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/uvicorn@0.11.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-7694 is fixed in version 0.11.6.post1+tuxcare of uvicorn.", "vulnerability": { "name": "CVE-2020-7694" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/uvicorn@0.11.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/uvicorn@0.11.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-7695 is fixed in version 0.11.6.post1+tuxcare of uvicorn.", "vulnerability": { "name": "CVE-2020-7695" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pytest@8.4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pytest@8.4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-71176 is fixed in version 8.4.2.post1+tuxcare of pytest.", "vulnerability": { "name": "CVE-2025-71176" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@3.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@3.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 3.6.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@3.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@3.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45409 is fixed in version 3.6.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2026-45409" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.30.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.30.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.30.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.30.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 2.12.0.post1+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 2.12.0.post1+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10086 is fixed in version 2.11.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "AIKIDO-2024-10086" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10560 is fixed in version 2.11.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "AIKIDO-2024-10560" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22195 is fixed in version 2.11.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-22195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34064 is fixed in version 2.11.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-34064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56201 affects version 2.11.3.post1+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56201" }, "action_statement": "Vulnerability CVE-2024-56201 affects version 2.11.3.post1+tuxcare of jinja2." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56326 affects version 2.11.3.post1+tuxcare of jinja2, and is fixed in 2.11.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-56326" }, "action_statement": "Vulnerability CVE-2024-56326 affects version 2.11.3.post1+tuxcare of jinja2, and is fixed in 2.11.3.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27516 affects version 2.11.3.post1+tuxcare of jinja2, and is fixed in 2.11.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-27516" }, "action_statement": "Vulnerability CVE-2025-27516 affects version 2.11.3.post1+tuxcare of jinja2, and is fixed in 2.11.3.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10318 is fixed in version 2.14.7.post2+tuxcare of fastmcp.", "vulnerability": { "name": "AIKIDO-2026-10318" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64340 is fixed in version 2.14.7.post2+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2025-64340" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27124 is fixed in version 2.14.7.post2+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-27124" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastmcp@2.14.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32871 is fixed in version 2.14.7.post2+tuxcare of fastmcp.", "vulnerability": { "name": "CVE-2026-32871" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22195 is fixed in version 3.0.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-22195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34064 is fixed in version 3.0.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-34064" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56201 is fixed in version 3.0.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56326 is fixed in version 3.0.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56326" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@3.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@3.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27516 is fixed in version 3.0.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2025-27516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-1010083 is fixed in version 0.12.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 0.12.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 0.12.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27454 is fixed in version 3.8.5.post2+tuxcare of orjson.", "vulnerability": { "name": "CVE-2024-27454" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67221 affects version 3.8.5.post2+tuxcare of orjson, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-67221" }, "action_statement": "Vulnerability CVE-2025-67221 affects version 3.8.5.post2+tuxcare of orjson, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-32681 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-32681" }, "action_statement": "Vulnerability CVE-2023-32681 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-25645" }, "action_statement": "Vulnerability CVE-2026-25645 affects version 2.25.1.post1+tuxcare of requests, and is fixed in 2.25.1.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymysql@0.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymysql@0.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-36039 is fixed in version 0.10.1.post1+tuxcare of pymysql.", "vulnerability": { "name": "CVE-2024-36039" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10086 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "AIKIDO-2024-10086" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10560 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "AIKIDO-2024-10560" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22195 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-22195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34064 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-34064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56201 affects version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56201" }, "action_statement": "Vulnerability CVE-2024-56201 affects version 2.11.3.post2+tuxcare of jinja2." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56326 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2024-56326" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/jinja2@2.11.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/jinja2@2.11.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27516 is fixed in version 2.11.3.post2+tuxcare of jinja2.", "vulnerability": { "name": "CVE-2025-27516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-24486" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-40347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-42561" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53537" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53538" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 is fixed in version 0.0.6.post7+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53540" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/httpx@0.22.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/httpx@0.22.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41945 is fixed in version 0.22.0.post1+tuxcare of httpx.", "vulnerability": { "name": "CVE-2021-41945" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64439 is fixed in version 2.1.2.post1+tuxcare of langgraph-checkpoint.", "vulnerability": { "name": "CVE-2025-64439" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27794 affects version 2.1.2.post1+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-27794" }, "action_statement": "Vulnerability CVE-2026-27794 affects version 2.1.2.post1+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langgraph-checkpoint@2.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48775 affects version 2.1.2.post1+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48775" }, "action_statement": "Vulnerability CVE-2026-48775 affects version 2.1.2.post1+tuxcare of langgraph-checkpoint, and is fixed in 2.1.2.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@3.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@3.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 3.6.post1+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/idna@3.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@3.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45409 affects version 3.6.post1+tuxcare of idna, and is fixed in 3.6.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-45409" }, "action_statement": "Vulnerability CVE-2026-45409 affects version 3.6.post1+tuxcare of idna, and is fixed in 3.6.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pytest@7.4.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pytest@7.4.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-71176 is fixed in version 7.4.4.post1+tuxcare of pytest.", "vulnerability": { "name": "CVE-2025-71176" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/h11@0.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/h11@0.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-43859 is fixed in version 0.9.0.post1+tuxcare of h11.", "vulnerability": { "name": "CVE-2025-43859" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-20916 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2019-20916" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3572 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2021-3572" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-5752 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2023-5752" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-8869 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2025-8869" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-13346 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-13346" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1703 affects version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-1703" }, "action_statement": "Vulnerability CVE-2026-1703 affects version 9.0.0.post3+tuxcare of pip." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3219 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-3219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6357 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-6357" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pip@9.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pip@9.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8643 is fixed in version 9.0.0.post3+tuxcare of pip.", "vulnerability": { "name": "CVE-2026-8643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tqdm@4.66.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tqdm@4.66.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34062 is fixed in version 4.66.1.post1+tuxcare of tqdm.", "vulnerability": { "name": "CVE-2024-34062" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/deepdiff@6.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/deepdiff@6.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58367 is fixed in version 6.2.3.post1+tuxcare of deepdiff.", "vulnerability": { "name": "CVE-2025-58367" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/deepdiff@6.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/deepdiff@6.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33155 affects version 6.2.3.post1+tuxcare of deepdiff, and is fixed in 6.2.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-33155" }, "action_statement": "Vulnerability CVE-2026-33155 affects version 6.2.3.post1+tuxcare of deepdiff, and is fixed in 6.2.3.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/apache-airflow-providers-http@4.13.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/apache-airflow-providers-http@4.13.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69219 is fixed in version 4.13.3.post1+tuxcare of apache-airflow-providers-http.", "vulnerability": { "name": "CVE-2025-69219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/deepdiff@6.2.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/deepdiff@6.2.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58367 is fixed in version 6.2.3.post2+tuxcare of deepdiff.", "vulnerability": { "name": "CVE-2025-58367" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/deepdiff@6.2.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/deepdiff@6.2.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33155 is fixed in version 6.2.3.post2+tuxcare of deepdiff.", "vulnerability": { "name": "CVE-2026-33155" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27454 affects version 3.8.5.post1+tuxcare of orjson, and is fixed in 3.8.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-27454" }, "action_statement": "Vulnerability CVE-2024-27454 affects version 3.8.5.post1+tuxcare of orjson, and is fixed in 3.8.5.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/orjson@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/orjson@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67221 affects version 3.8.5.post1+tuxcare of orjson, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-67221" }, "action_statement": "Vulnerability CVE-2025-67221 affects version 3.8.5.post1+tuxcare of orjson, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53981 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2024-53981" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24486 affects version 0.0.6.post5+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-24486" }, "action_statement": "Vulnerability CVE-2026-24486 affects version 0.0.6.post5+tuxcare of python-multipart, and is fixed in 0.0.6.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40347 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-40347" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42561 affects version 0.0.6.post5+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42561" }, "action_statement": "Vulnerability CVE-2026-42561 affects version 0.0.6.post5+tuxcare of python-multipart, and is fixed in 0.0.6.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53537 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53537" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53538 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53538" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/python-multipart@0.0.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53540 is fixed in version 0.0.6.post5+tuxcare of python-multipart.", "vulnerability": { "name": "CVE-2026-53540" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lightgbm@3.3.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lightgbm@3.3.5.post1+tuxcare" } } ], "timestamp": "2026-09-29T11:11:04.521924+00:00", "status_notes": "Vulnerability CVE-2024-43598 is fixed in version 3.3.5.post1+tuxcare of lightgbm.", "vulnerability": { "name": "CVE-2024-43598" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10370 is fixed in version 2.7.0.post2+tuxcare of sentence-transformers.", "vulnerability": { "name": "AIKIDO-2024-10370" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T10:48:20.051130+00:00", "status_notes": "Vulnerability CVE-2026-68770 affects version 2.7.0.post2+tuxcare of sentence-transformers, and is fixed in 2.7.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-68770" }, "action_statement": "Vulnerability CVE-2026-68770 affects version 2.7.0.post2+tuxcare of sentence-transformers, and is fixed in 2.7.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10370 is fixed in version 2.7.0.post1+tuxcare of sentence-transformers.", "vulnerability": { "name": "AIKIDO-2024-10370" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T10:48:20.051130+00:00", "status_notes": "Vulnerability CVE-2026-68770 affects version 2.7.0.post1+tuxcare of sentence-transformers, and is fixed in 2.7.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-68770" }, "action_statement": "Vulnerability CVE-2026-68770 affects version 2.7.0.post1+tuxcare of sentence-transformers, and is fixed in 2.7.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T10:48:20.051130+00:00", "status_notes": "Vulnerability AIKIDO-2024-10370 is fixed in version 2.7.0.post3+tuxcare of sentence-transformers.", "vulnerability": { "name": "AIKIDO-2024-10370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T10:48:20.051130+00:00", "status_notes": "Vulnerability CVE-2026-68770 is fixed in version 2.7.0.post3+tuxcare of sentence-transformers.", "vulnerability": { "name": "CVE-2026-68770" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@25.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@25.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T08:34:24.527770+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 25.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@25.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@25.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T08:34:24.527770+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 25.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 24.3.0.post3+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@24.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@24.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 24.3.0.post3+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/h11@0.12.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/h11@0.12.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T08:22:55.479914+00:00", "status_notes": "Vulnerability CVE-2025-43859 is fixed in version 0.12.0.post1+tuxcare of h11.", "vulnerability": { "name": "CVE-2025-43859" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post3+tuxcare" } } ], "timestamp": "2026-10-05T11:23:00.071596+00:00", "status_notes": "Vulnerability CVE-2019-1010083 is fixed in version 0.12.5.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post3+tuxcare" } } ], "timestamp": "2026-10-05T11:23:00.071596+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 0.12.5.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@0.12.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@0.12.5.post3+tuxcare" } } ], "timestamp": "2026-10-05T11:23:00.071596+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 0.12.5.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/apache-airflow-providers-http@4.13.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/apache-airflow-providers-http@4.13.3.post2+tuxcare" } } ], "timestamp": "2026-10-05T11:38:00.152218+00:00", "status_notes": "Vulnerability CVE-2025-69219 is fixed in version 4.13.3.post2+tuxcare of apache-airflow-providers-http.", "vulnerability": { "name": "CVE-2025-69219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.25.1.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.25.1.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.25.1.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.25.1.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2023-23934 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" }, "action_statement": "Vulnerability CVE-2023-23934 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:12:00.080134+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2023-46136 does not affect version 0.16.1.post1+tuxcare of werkzeug. werkzeug 0.16.1: vulnerable sansio MultipartDecoder (2.x+) absent; legacy line parser uses make_line_iter(cap_at_buffer=True), CR/LF-prefixed 64MB part parses in linear time (0.06s vs 6.35s on 2.3.7). esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-46136" }, "impact_statement": "werkzeug 0.16.1: vulnerable sansio MultipartDecoder (2.x+) absent; legacy line parser uses make_line_iter(cap_at_buffer=True), CR/LF-prefixed 64MB part parses in linear time (0.06s vs 6.35s on 2.3.7). esultanaliev 2026-10-02" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:12:00.080134+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2024-49766 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" }, "action_statement": "Vulnerability CVE-2024-49766 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2024-49767 does not affect version 0.16.1.post1+tuxcare of werkzeug. werkzeug 0.16.1: MultiPartParser.parse_parts already accumulates in_memory across _cont events and checks max_form_memory_size each event (what upstream 8760275a adds to sansio parser); PoC that bypasses 3.0.5 is rejected on 0.16.1. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-49767" }, "impact_statement": "werkzeug 0.16.1: MultiPartParser.parse_parts already accumulates in_memory across _cont events and checks max_form_memory_size each event (what upstream 8760275a adds to sansio parser); PoC that bypasses 3.0.5 is rejected on 0.16.1. esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@0.16.1.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:11:00.076340+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 0.16.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 0.16.1.post1+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lxml@4.6.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.6.5.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-2309 is fixed in version 4.6.5.post2+tuxcare of lxml.", "vulnerability": { "name": "CVE-2022-2309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lxml@4.6.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.6.5.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-41066 is fixed in version 4.6.5.post2+tuxcare of lxml.", "vulnerability": { "name": "CVE-2026-41066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.25.1.post5+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.25.1.post5+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.25.1.post5+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.25.1.post5+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/lxml@4.6.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.6.5.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-2309 affects version 4.6.5.post1+tuxcare of lxml, and is fixed in 4.6.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2022-2309" }, "action_statement": "Vulnerability CVE-2022-2309 affects version 4.6.5.post1+tuxcare of lxml, and is fixed in 4.6.5.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lxml@4.6.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.6.5.post1+tuxcare" } } ], "timestamp": "2026-10-05T10:28:00.076602+00:00", "status_notes": "Vulnerability CVE-2026-41066 is fixed in version 4.6.5.post1+tuxcare of lxml.", "vulnerability": { "name": "CVE-2026-41066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post6+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post6+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 1.0.1.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.8.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.8.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.8.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-45409 is fixed in version 2.8.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2026-45409" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.8.post1+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/idna@2.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.8.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-45409 affects version 2.8.post1+tuxcare of idna, and is fixed in 2.8.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-45409" }, "action_statement": "Vulnerability CVE-2026-45409 affects version 2.8.post1+tuxcare of idna, and is fixed in 2.8.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.1.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-45409 is fixed in version 2.1.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2026-45409" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 1.0.1.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 1.0.1.post5+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 1.0.1.post3+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-23934 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-102598" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 1.0.1.post7+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.1.post1+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/idna@2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-45409 affects version 2.1.post1+tuxcare of idna, and is fixed in 2.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-45409" }, "action_statement": "Vulnerability CVE-2026-45409 affects version 2.1.post1+tuxcare of idna, and is fixed in 2.1.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post2+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare.", "vulnerability": { "name": "AIKIDO-2024-10410" }, "action_statement": "Vulnerability AIKIDO-2024-10410 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-23934" }, "action_statement": "Vulnerability CVE-2023-23934 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 1.0.1.post2+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post2+tuxcare.", "vulnerability": { "name": "AIKIDO-2024-10085" }, "action_statement": "Vulnerability AIKIDO-2024-10085 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare.", "vulnerability": { "name": "AIKIDO-2024-10410" }, "action_statement": "Vulnerability AIKIDO-2024-10410 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-23934" }, "action_statement": "Vulnerability CVE-2023-23934 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-34069" }, "action_statement": "Vulnerability CVE-2024-34069 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 1.0.1.post1+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23934 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-23934" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-25577 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 1.0.1.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@1.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 1.0.1.post4+tuxcare of werkzeug, and is fixed in 1.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/httpx@0.22.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/httpx@0.22.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:54:00.152714+00:00", "status_notes": "Vulnerability CVE-2021-41945 is fixed in version 0.22.0.post2+tuxcare of httpx.", "vulnerability": { "name": "CVE-2021-41945" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.10.post1+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/idna@2.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.10.post1+tuxcare" } } ], "timestamp": "2026-10-09T07:17:00.146702+00:00", "status_notes": "Vulnerability CVE-2026-45409 affects version 2.10.post1+tuxcare of idna, and is fixed in 2.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-45409" }, "action_statement": "Vulnerability CVE-2026-45409 affects version 2.10.post1+tuxcare of idna, and is fixed in 2.10.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.10.post2+tuxcare" } } ], "timestamp": "2026-10-09T07:17:00.146702+00:00", "status_notes": "Vulnerability CVE-2024-3651 is fixed in version 2.10.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2024-3651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/idna@2.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/idna@2.10.post2+tuxcare" } } ], "timestamp": "2026-10-09T07:17:00.146702+00:00", "status_notes": "Vulnerability CVE-2026-45409 is fixed in version 2.10.post2+tuxcare of idna.", "vulnerability": { "name": "CVE-2026-45409" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post6+tuxcare" } } ], "timestamp": "2026-10-09T08:35:11.376902+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.25.1.post6+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post6+tuxcare" } } ], "timestamp": "2026-10-09T08:35:11.376902+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.25.1.post6+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post6+tuxcare" } } ], "timestamp": "2026-10-09T08:35:11.376902+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.25.1.post6+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.25.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.25.1.post6+tuxcare" } } ], "timestamp": "2026-10-09T08:35:11.376902+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.25.1.post6+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pdfkit@0.6.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pdfkit@0.6.1.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:57:00.107170+00:00", "status_notes": "Vulnerability CVE-2022-25765 does not affect version 0.6.1.post1+tuxcare of pdfkit. CVE-2022-25765 is in the Ruby gem pdfkit (github.com/pdfkit/pdfkit, lib/pdfkit/pdfkit.rb, fixed in gem 0.8.7.2). The Python package pdfkit 0.6.1 (JazzCore/python-pdfkit) is a different project: its wheel contains only pdfkit/*.py, no Ruby code. Checked 2026-10-19.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-25765" }, "impact_statement": "CVE-2022-25765 is in the Ruby gem pdfkit (github.com/pdfkit/pdfkit, lib/pdfkit/pdfkit.rb, fixed in gem 0.8.7.2). The Python package pdfkit 0.6.1 (JazzCore/python-pdfkit) is a different project: its wheel contains only pdfkit/*.py, no Ruby code. Checked 2026-10-19." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pdfkit@0.6.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pdfkit@0.6.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26240 is fixed in version 0.6.1.post1+tuxcare of pdfkit.", "vulnerability": { "name": "CVE-2025-26240" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyyaml@3.13.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyyaml@3.13.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2017-18342 is fixed in version 3.13.post1+tuxcare of pyyaml.", "vulnerability": { "name": "CVE-2017-18342" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyyaml@3.13.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyyaml@3.13.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2020-14343 is fixed in version 3.13.post1+tuxcare of pyyaml.", "vulnerability": { "name": "CVE-2020-14343" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langchain-text-splitters@0.3.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-text-splitters@0.3.11.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-41481 is fixed in version 0.3.11.post1+tuxcare of langchain-text-splitters.", "vulnerability": { "name": "CVE-2026-41481" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langchain-text-splitters@0.3.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-text-splitters@0.3.11.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fv5p-p927-qmxr is fixed in version 0.3.11.post1+tuxcare of langchain-text-splitters.", "vulnerability": { "name": "GHSA-fv5p-p927-qmxr" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/py@1.11.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/py@1.11.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-42969 is fixed in version 1.11.0.post1+tuxcare of py.", "vulnerability": { "name": "CVE-2022-42969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T08:01:18.045459+00:00", "status_notes": "Vulnerability AIKIDO-2024-10370 is fixed in version 2.7.0.post4+tuxcare of sentence-transformers.", "vulnerability": { "name": "AIKIDO-2024-10370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/sentence-transformers@2.7.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/sentence-transformers@2.7.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T08:01:18.045459+00:00", "status_notes": "Vulnerability CVE-2026-68770 is fixed in version 2.7.0.post4+tuxcare of sentence-transformers.", "vulnerability": { "name": "CVE-2026-68770" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T09:58:00.084087+00:00", "status_notes": "Vulnerability CVE-2023-32681 is fixed in version 2.30.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2023-32681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T09:58:00.084087+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.30.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T09:58:00.084087+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.30.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.30.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.30.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T09:58:00.084087+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.30.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-47874" }, "action_statement": "Vulnerability CVE-2024-47874 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post1+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post1+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post3+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "action_statement": "Vulnerability GHSA-93gm-qmq6-w238 affects version 0.13.6.post1+tuxcare of starlette, and is fixed in 0.13.6.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post1+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-29370 is a false positive for python-jose 3.3.0.post1+tuxcare.", "vulnerability": { "name": "CVE-2024-29370" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-33663 affects version 3.3.0.post1+tuxcare of python-jose, and is fixed in 3.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-33663" }, "action_statement": "Vulnerability CVE-2024-33663 affects version 3.3.0.post1+tuxcare of python-jose, and is fixed in 3.3.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-33664 is fixed in version 3.3.0.post1+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2024-33664" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T06:35:00.206685+00:00", "status_notes": "Vulnerability CVE-2026-85394 affects version 3.3.0.post1+tuxcare of python-jose, and is fixed in 3.3.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-85394" }, "action_statement": "Vulnerability CVE-2026-85394 affects version 3.3.0.post1+tuxcare of python-jose, and is fixed in 3.3.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32677 is fixed in version 0.63.0.post4+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.63.0.post4+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.63.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32677 is fixed in version 0.63.0.post1+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.63.0.post1+tuxcare of fastapi, and is fixed in 0.63.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.63.0.post1+tuxcare of fastapi, and is fixed in 0.63.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.63.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post5+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.13.6.post5+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.13.6.post5+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post5+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is fixed in version 0.13.6.post5+tuxcare of starlette.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post5+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32677 is fixed in version 0.63.0.post5+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.63.0.post5+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.63.0.post5+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-29370 is a false positive for python-jose 3.3.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-29370" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T06:34:00.074806+00:00", "status_notes": "Vulnerability CVE-2024-33663 is fixed in version 3.3.0.post3+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2024-33663" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T06:34:00.074806+00:00", "status_notes": "Vulnerability CVE-2024-33664 is fixed in version 3.3.0.post3+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2024-33664" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T06:35:00.206685+00:00", "status_notes": "Vulnerability CVE-2026-85394 is fixed in version 3.3.0.post3+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2026-85394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post6+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post6+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is fixed in version 0.13.6.post6+tuxcare of starlette.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post6+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post4+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.13.6.post4+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post4+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is fixed in version 0.13.6.post4+tuxcare of starlette.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post4+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32677 is fixed in version 0.63.0.post2+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.63.0.post2+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.63.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 is fixed in version 0.13.6.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-47874" }, "action_statement": "Vulnerability CVE-2024-47874 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post3+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.13.6.post3+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post3+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is fixed in version 0.13.6.post3+tuxcare of starlette.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post3+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30798 is fixed in version 0.13.6.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-47874" }, "action_statement": "Vulnerability CVE-2024-47874 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.13.6.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-25T03:22:44.885595+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.13.6.post2+tuxcare of starlette. starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "starlette 0.13.6 is not vulnerable to CVE-2025-62727: the quadratic Range-header parsing/merging in FileResponse was introduced in 0.39.0; responses.py on tuxcare-current/0.13.6 contains no Range handling at all (verified 2026-09-25, esultanaliev). Same conclusion as the leader VPV 81209 (0.27.0)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-3qj8-93xh-pwh2 is a false positive for starlette 0.13.6.post2+tuxcare.", "vulnerability": { "name": "GHSA-3qj8-93xh-pwh2" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post3+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "action_statement": "Vulnerability GHSA-93gm-qmq6-w238 affects version 0.13.6.post2+tuxcare of starlette, and is fixed in 0.13.6.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.13.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.13.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.13.6.post2+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-29370 is a false positive for python-jose 3.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-29370" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-33663 is fixed in version 3.3.0.post2+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2024-33663" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-33664 is fixed in version 3.3.0.post2+tuxcare of python-jose.", "vulnerability": { "name": "CVE-2024-33664" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/python-jose@3.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/python-jose@3.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T06:35:00.206685+00:00", "status_notes": "Vulnerability CVE-2026-85394 affects version 3.3.0.post2+tuxcare of python-jose, and is fixed in 3.3.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-85394" }, "action_statement": "Vulnerability CVE-2026-85394 affects version 3.3.0.post2+tuxcare of python-jose, and is fixed in 3.3.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-32677 is fixed in version 0.63.0.post3+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.63.0.post3+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.63.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.63.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.63.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/future@1.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/future@1.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-50817 is a false positive for future 1.0.0.post1+tuxcare.", "vulnerability": { "name": "CVE-2025-50817" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23491 is fixed in version 2021.10.8.post4+tuxcare of certifi.", "vulnerability": { "name": "CVE-2022-23491" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37920 is fixed in version 2021.10.8.post4+tuxcare of certifi.", "vulnerability": { "name": "CVE-2023-37920" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 is fixed in version 2021.10.8.post4+tuxcare of certifi.", "vulnerability": { "name": "CVE-2024-39689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post4+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post4+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post4+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37920 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-37920" }, "action_statement": "Vulnerability CVE-2023-37920 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-39689" }, "action_statement": "Vulnerability CVE-2024-39689 affects version 2021.10.8.post1+tuxcare of certifi, and is fixed in 2021.10.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post1+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post1+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2021.10.8.post3+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2021.10.8.post3+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37920 affects version 2021.10.8.post3+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-37920" }, "action_statement": "Vulnerability CVE-2023-37920 affects version 2021.10.8.post3+tuxcare of certifi, and is fixed in 2021.10.8.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 is fixed in version 2021.10.8.post3+tuxcare of certifi.", "vulnerability": { "name": "CVE-2024-39689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2021.10.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2021.10.8.post3+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post3+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2021.10.8.post3+tuxcare of certifi." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post10+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post10+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post10+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post10+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post10+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post3+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post3+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post3+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post3+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post3+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post15+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post15+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post15+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post15+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post15+tuxcare" } } ], "timestamp": "2026-09-30T06:17:00.175527+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post4+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post4+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post4+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post4+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post4+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post11+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post11+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post11+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post11+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post11+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post14+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post14+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post14+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post14+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post14+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post13+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post13+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post13+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post13+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post12+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post12+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post12+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post12+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post12+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post17+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post17+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post17+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post17+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post17+tuxcare" } } ], "timestamp": "2026-10-09T07:24:00.113423+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post1+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post1+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post1+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post1+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post1+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post2+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post2+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post2+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post2+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post20+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post20+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post20+tuxcare" } } ], "timestamp": "2026-10-22T02:40:23.825721+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post20+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post8+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post8+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post8+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post8+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post8+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post8+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post5+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post5+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post5+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post5+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post5+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post16+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post16+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post16+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post16+tuxcare" } } ], "timestamp": "2026-10-07T12:50:53.426717+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post18+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post18+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post18+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post18+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post18+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post9+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post9+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post9+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post9+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post9+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post19+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post19+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post19+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post19+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post19+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post19+tuxcare" } } ], "timestamp": "2026-10-21T10:12:08.730150+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post6+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post6+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post6+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post6+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.1.post6+tuxcare of aiohttp, and is fixed in 3.8.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:02:08.318892+00:00", "status_notes": "Vulnerability CVE-2022-33124 is a false positive for aiohttp 3.8.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2022-33124" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-22T02:41:04.880145+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.1.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.1.post10+tuxcare. The vulnerability requires the ability to specify custom per-request server_hostname parameters, a feature that was introduced in version 3.10.0. Version 3.8.1 hardcodes server_hostname to the request host, making the attack scenario impossible." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.1.post7+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp 3.8.1.post10+tuxcare) is not affected by CVE-2026-54276. The vulnerable component DigestAuthMiddleware was introduced in version 3.12+ and does not exist in this older version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-07T12:55:34.476601+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.1.post7+tuxcare of aiohttp. CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "CVE-2026-54280 fix already exists in commit 5eba7627a9a5f887219dfb68908be995c0e15cbe" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.1.post7+tuxcare of aiohttp, and is fixed in 3.8.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.1.post7+tuxcare of aiohttp. not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 Version 3.8.1 is not affected by CVE-2026-69244. The vulnerability exists in aiohttp 3.14+ where the C parser constructs detailed error messages with buffer snippets using llhttp_get_error_pos() followed by .split() on a raw pointer, causing out-of-bounds heap reads. Version 3.8.1 uses a simpler error reporting mechanism that only calls llhttp_get_error_reason() to get static error strings - it..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.1.post7+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.1.post7+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post6+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post6+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post6+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post6+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post6+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post6+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post6+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post6+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post4+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post4+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post4+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post4+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post4+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post4+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post4+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post4+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post16+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post16+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post16+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post16+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post16+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post16+tuxcare" } } ], "timestamp": "2026-10-09T06:55:10.864338+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post13+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post13+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post13+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post13+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post13+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post12+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post12+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post12+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post12+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post12+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post12+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post12+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post8+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post8+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post8+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post8+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post8+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post8+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post8+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post8+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post2+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post2+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post2+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post2+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post2+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post2+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post15+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post15+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post15+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post15+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post15+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post15+tuxcare" } } ], "timestamp": "2026-10-08T11:37:00.107925+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post5+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post5+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post5+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post5+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post5+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post5+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post5+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post5+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post1+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post1+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post1+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post1+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post1+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post1+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post11+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post11+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post11+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post11+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post11+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post11+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post9+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post9+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post9+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post9+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post9+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post9+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post3+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post3+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post3+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post3+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post3+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post3+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post3+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post18+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post18+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post18+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post18+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post18+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post18+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post18+tuxcare" } } ], "timestamp": "2026-10-21T09:50:00.674866+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post10+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post10+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post10+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post10+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post10+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post10+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post17+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post17+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post17+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post17+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post17+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post17+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post17+tuxcare" } } ], "timestamp": "2026-10-20T08:10:27.256705+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post14+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post14+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post14+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post14+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post14+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:50:12.979064+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post19+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post19+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post19+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post19+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post19+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37276 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-08T11:39:00.216509+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-09T06:57:00.083071+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.4.post7+tuxcare of aiohttp. aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp/_cookie_helpers.py and its per-cookie internal_logger.warning() first exist in aiohttp 3.12.7 (OSV GIT range introduced 80bb38fa). On tuxcare-current/3.8.4 BaseRequest.cookies is stdlib SimpleCookie, which drops invalid cookies silently and logs nothing: an attack request with 3000 illegal cookie names produces 0 log records on this branch. Same disposition as VPV 18638 (3.8.5, MR !138 closed 2026-09-15). MR !146 rejected and closed." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T08:13:00.171857+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post17+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T21:06:00.116690+00:00", "status_notes": "Vulnerability CVE-2026-111065 does not affect version 3.8.4.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-111065" }, "impact_statement": "not_affected \u2014 CVE-2026-111065 describes an overflow in Max-Age processing that can skip closing connections. Analysis of aiohttp 3.8.4.post17+tuxcare shows comprehensive exception handling for all Max-Age overflow scenarios in cookiejar.py (lines 307-319). The code properly catches both OverflowError (from datetime operations) and ValueError (from int conversion). No CVE-2026-111065 references exist in the g..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:04:04.856753+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.4.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.8.4.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.4.post7+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.4.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.4.post4+tuxcare. The vulnerability requires the server_hostname parameter feature, which was not added until version 3.9.0+ (August 2023), six months after version 3.8.4 was released (February 2023). The target version cannot receive the malicious input described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.4.post7+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.4.post4+tuxcare) does not contain the DigestAuthMiddleware component. This feature was introduced in aiohttp version 3.12, which postdates the target version. The vulnerability cannot manifest because the affected code does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.4.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:59:00.176583+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.4.post7+tuxcare of aiohttp, and is fixed in 3.8.4.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 does not affect version 3.8.4.post7+tuxcare of aiohttp. not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69244" }, "impact_statement": "not_affected \u2014 reassessed 2026-09-09 (PYELS-169). CVE-2026-69244 is an out-of-bounds heap read in the C response parser's error-snippet builder: it slices from llhttp_get_error_pos() as a NUL-terminated C string (upstream fix 49f65d54, PR #13223). That snippet code was introduced in aiohttp 3.8.5 (v3.8.4..v3.8.5 diff of _http_parser.pyx), not 3.9.0 as previously stated. tuxcare-current/3.8.4 calls parser_error_from_errno(self._cparser) with no snippet and never reads through the error position, so the vulnerable code is not present. Note: the CVE's regression tests rely on llhttp 9 rejecting bare-CR chunk framing; 3.8.4 still vendors llhttp 8.1.1, which accepts `0\\rX\\r\\n` as a chunk-size line (probed on the shipped 3.8.4.post8 wheel) \u2014 that is a separate hardening item (llhttp 9.1.3 bump, done on 3.8.5 in MR !133), not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-10-19T17:19:00.295368+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 does not affect version 3.8.4.post7+tuxcare of aiohttp. not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20...", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "impact_statement": "not_affected \u2014 aiohttp 3.8.4.post16+tuxcare is not affected by resource exhaustion through attacker-controlled requests. The target has comprehensive default protections: client_max_size defaults to 1MB (1024**2), Request.read() and Request.post() enforce size limits before accumulating data, multipart handling uses chunked reading with size checks, and multiple prior TuxCare backports (CVE-2025-69229, CVE-20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post7+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.4.post7+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-40897 is fixed in version 60.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2022-40897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 60.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 affects version 60.0.0.post2+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-47273" }, "action_statement": "Vulnerability CVE-2025-47273 affects version 60.0.0.post2+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 60.0.0.post2+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 60.0.0.post2+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-40897 is fixed in version 59.8.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2022-40897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-47273" }, "action_statement": "Vulnerability CVE-2025-47273 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 59.8.0.post1+tuxcare of setuptools, and is fixed in 59.8.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 59.8.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 59.8.0.post1+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-40897 is fixed in version 60.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2022-40897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 60.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 60.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 60.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post3+tuxcare of setuptools." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-40897 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2022-40897" }, "action_statement": "Vulnerability CVE-2022-40897 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 60.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-47273" }, "action_statement": "Vulnerability CVE-2025-47273 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 60.0.0.post1+tuxcare of setuptools, and is fixed in 60.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@60.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@60.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 60.0.0.post1+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-40897 is fixed in version 59.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2022-40897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 59.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 59.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 59.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@59.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@59.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 59.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 59.8.0.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102993 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102994 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102994" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102995 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102995" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102996 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102996" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102997 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102997" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102998 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102998" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-102999 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102999" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post21+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113786" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113789 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113789" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113790 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113790" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113791 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113791" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113792" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113793" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113794" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-115572 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115572" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-115580 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-115585 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115585" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-28804 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-33123 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33123" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-33699 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-40260 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-40260" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-82398 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-82398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-84309 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-84310 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-84311 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post21+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post21+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post9+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post9+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post9+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post7+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post7+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post7+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post12+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post12+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post12+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post11+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post11+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post11+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post8+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post8+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post8+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post5+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post5+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post5+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post5+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post5+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41168" }, "action_statement": "Vulnerability CVE-2026-41168 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41312" }, "action_statement": "Vulnerability CVE-2026-41312 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post5+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41314" }, "action_statement": "Vulnerability CVE-2026-41314 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post5+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102993 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102994 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102994" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102995 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102995" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102996 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102996" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102997 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102997" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102998 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102998" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-102999 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102999" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post20+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113789" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113790" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-113791" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post20+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115572" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-115585" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-28804 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-33123 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33123" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-33699 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-40260 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-40260" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-82398 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-82398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-84309 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-84310 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-84311 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post20+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post20+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/apache-airflow-providers-http@4.13.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/apache-airflow-providers-http@4.13.3.post3+tuxcare" } } ], "timestamp": "2026-10-26T22:16:00.247055+00:00", "status_notes": "Vulnerability CVE-2025-69219 is fixed in version 4.13.3.post3+tuxcare of apache-airflow-providers-http.", "vulnerability": { "name": "CVE-2025-69219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post6+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post6+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post6+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post4+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post4+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post4+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post4+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post4+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41168" }, "action_statement": "Vulnerability CVE-2026-41168 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41312" }, "action_statement": "Vulnerability CVE-2026-41312 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-41313" }, "action_statement": "Vulnerability CVE-2026-41313 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41314" }, "action_statement": "Vulnerability CVE-2026-41314 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post4+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post13+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post13+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post13+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post2+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post2+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-62708" }, "action_statement": "Vulnerability CVE-2025-62708 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post2+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-27628" }, "action_statement": "Vulnerability CVE-2026-27628 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41168" }, "action_statement": "Vulnerability CVE-2026-41168 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41312" }, "action_statement": "Vulnerability CVE-2026-41312 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-41313" }, "action_statement": "Vulnerability CVE-2026-41313 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41314" }, "action_statement": "Vulnerability CVE-2026-41314 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post2+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102993 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102994 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102994" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102995" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102996 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102996" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102997" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102998 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102998" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102999 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102999" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post19+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post19+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-28804 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-33123 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33123" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-33699 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-40260" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-82398 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-82398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-84309 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-84310 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-84311 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post19+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post14+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post14+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post14+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post1+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-62707" }, "action_statement": "Vulnerability CVE-2025-62707 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-62708" }, "action_statement": "Vulnerability CVE-2025-62708 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post1+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-27628" }, "action_statement": "Vulnerability CVE-2026-27628 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41168" }, "action_statement": "Vulnerability CVE-2026-41168 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41312" }, "action_statement": "Vulnerability CVE-2026-41312 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-41313" }, "action_statement": "Vulnerability CVE-2026-41313 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41314" }, "action_statement": "Vulnerability CVE-2026-41314 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post1+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post10+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post10+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post10+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post3+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post3+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post3+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post3+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-27628" }, "action_statement": "Vulnerability CVE-2026-27628 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-31826" }, "action_statement": "Vulnerability CVE-2026-31826 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41168" }, "action_statement": "Vulnerability CVE-2026-41168 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41312" }, "action_statement": "Vulnerability CVE-2026-41312 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-41313" }, "action_statement": "Vulnerability CVE-2026-41313 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-41314" }, "action_statement": "Vulnerability CVE-2026-41314 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-48155" }, "action_statement": "Vulnerability CVE-2026-48155 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48156" }, "action_statement": "Vulnerability CVE-2026-48156 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-48735" }, "action_statement": "Vulnerability CVE-2026-48735 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-49460" }, "action_statement": "Vulnerability CVE-2026-49460 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-49461" }, "action_statement": "Vulnerability CVE-2026-49461 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54530" }, "action_statement": "Vulnerability CVE-2026-54530 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-54531" }, "action_statement": "Vulnerability CVE-2026-54531 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-54651" }, "action_statement": "Vulnerability CVE-2026-54651 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-59935" }, "action_statement": "Vulnerability CVE-2026-59935 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-59936" }, "action_statement": "Vulnerability CVE-2026-59936 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59937" }, "action_statement": "Vulnerability CVE-2026-59937 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-59938" }, "action_statement": "Vulnerability CVE-2026-59938 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71852" }, "action_statement": "Vulnerability CVE-2026-71852 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-71870" }, "action_statement": "Vulnerability CVE-2026-71870 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" }, "action_statement": "Vulnerability GHSA-jm82-fx9c-mx94 affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" }, "action_statement": "Vulnerability GHSA-x284-j5p8-9c5p affects version 5.9.0.post3+tuxcare of pypdf, and is fixed in 5.9.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post16+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post16+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post16+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post17+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33123" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33699" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-82398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84311" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post17+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post17+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66019 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-66019" }, "action_statement": "Vulnerability CVE-2025-66019 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102993" }, "action_statement": "Vulnerability CVE-2026-102993 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102994" }, "action_statement": "Vulnerability CVE-2026-102994 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102996" }, "action_statement": "Vulnerability CVE-2026-102996 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102998" }, "action_statement": "Vulnerability CVE-2026-102998 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-102999" }, "action_statement": "Vulnerability CVE-2026-102999 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post15+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22690 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22690" }, "action_statement": "Vulnerability CVE-2026-22690 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22691 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-22691" }, "action_statement": "Vulnerability CVE-2026-22691 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-24688 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-24688" }, "action_statement": "Vulnerability CVE-2026-24688 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27024 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27024" }, "action_statement": "Vulnerability CVE-2026-27024 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27025 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27025" }, "action_statement": "Vulnerability CVE-2026-27025 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27026 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27026" }, "action_statement": "Vulnerability CVE-2026-27026 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27888 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-27888" }, "action_statement": "Vulnerability CVE-2026-27888 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28351 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-28351" }, "action_statement": "Vulnerability CVE-2026-28351 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-28804 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-28804" }, "action_statement": "Vulnerability CVE-2026-28804 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33123 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33123" }, "action_statement": "Vulnerability CVE-2026-33123 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33699 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-33699" }, "action_statement": "Vulnerability CVE-2026-33699 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-57204 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-57204" }, "action_statement": "Vulnerability CVE-2026-57204 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82398 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-82398" }, "action_statement": "Vulnerability CVE-2026-82398 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84309 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84309" }, "action_statement": "Vulnerability CVE-2026-84309 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84310 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84310" }, "action_statement": "Vulnerability CVE-2026-84310 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84311 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-84311" }, "action_statement": "Vulnerability CVE-2026-84311 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" }, "action_statement": "Vulnerability GHSA-9m86-7pmv-2852 affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post15+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post15+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-55197 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-55197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-62707 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62707" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-62708 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-62708" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66019 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2025-66019" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102993 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102994 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102994" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102995 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102995" }, "action_statement": "Vulnerability CVE-2026-102995 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102996 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102996" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-102997 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-102997" }, "action_statement": "Vulnerability CVE-2026-102997 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102998 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102998" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102999 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-102999" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-103000 does not affect version 5.9.0.post18+tuxcare of pypdf. Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103000" }, "impact_statement": "Unbounded alphabetical page labels come from upstream c38feda0 (#4065, released in 6.18.1), which made number2uppercase_letter repeat the letter (output linear in /St). pypdf 5.9.0 still uses the base-26 encoding (label length ~log26(n)), so the memory blow-up fixed by 0d8b5a88 cannot happen. Analysis in python-els/pypdf!52 (closed 2026-10-09)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113786 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113786" }, "action_statement": "Vulnerability CVE-2026-113786 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113789 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113789" }, "action_statement": "Vulnerability CVE-2026-113789 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113790 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113790" }, "action_statement": "Vulnerability CVE-2026-113790 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-113791 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-113791" }, "action_statement": "Vulnerability CVE-2026-113791 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113792 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113792" }, "action_statement": "Vulnerability CVE-2026-113792 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113793 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113793" }, "action_statement": "Vulnerability CVE-2026-113793 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113794 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113794" }, "action_statement": "Vulnerability CVE-2026-113794 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-113795 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2026-113795" }, "action_statement": "Vulnerability CVE-2026-113795 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115572 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115572" }, "action_statement": "Vulnerability CVE-2026-115572 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115580 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115580" }, "action_statement": "Vulnerability CVE-2026-115580 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-26T11:46:39.583037+00:00", "status_notes": "Vulnerability CVE-2026-115585 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-115585" }, "action_statement": "Vulnerability CVE-2026-115585 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-22690 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22690" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-22691 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-22691" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-24688 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-24688" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-27024 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27024" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-27025 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27025" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-27026 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27026" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-27628 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27628" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-27888 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-27888" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-28351 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-28804 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-28804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-31826 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-31826" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-33123 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33123" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-33699 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-33699" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40260 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-40260" }, "action_statement": "Vulnerability CVE-2026-40260 affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-41168 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41168" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-41312 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-41313 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41313" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-41314 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-41314" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48155 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48155" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48156 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48156" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48735 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-48735" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-49460 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-49461 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-49461" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-54530 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54530" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-54531 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54531" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-54651 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-54651" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-57204 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-57204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59935 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59935" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59936 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59936" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59937 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59938 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-59938" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-71852 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71852" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-71870 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-71870" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-82398 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-82398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-84309 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-84310 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-84311 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "CVE-2026-84311" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-4pxv-j86v-mhcw" }, "action_statement": "Vulnerability GHSA-4pxv-j86v-mhcw affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-7gw9-cf7v-778f" }, "action_statement": "Vulnerability GHSA-7gw9-cf7v-778f affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-9m86-7pmv-2852 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-9m86-7pmv-2852" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare.", "vulnerability": { "name": "GHSA-jj6c-8h6c-hppx" }, "action_statement": "Vulnerability GHSA-jj6c-8h6c-hppx affects version 5.9.0.post18+tuxcare of pypdf, and is fixed in 5.9.0.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-jm82-fx9c-mx94 is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-jm82-fx9c-mx94" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pypdf@5.9.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/pypdf@5.9.0.post18+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-x284-j5p8-9c5p is fixed in version 5.9.0.post18+tuxcare of pypdf.", "vulnerability": { "name": "GHSA-x284-j5p8-9c5p" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post3+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post3+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post3+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-47734" }, "action_statement": "Vulnerability CVE-2026-47734 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post3+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114094" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114095" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114096" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114098" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability CVE-2026-47712 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability CVE-2026-47734 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability CVE-2026-52726 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx is fixed in version 0.25.2.post8+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:43:00.087126+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 2.12.0.post3+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:43:00.087126+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 2.12.0.post3+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:11:28.177642+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 2.12.0.post2+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@2.12.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@2.12.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:11:28.177642+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 2.12.0.post2+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:56:08.633857+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 3.0.0.post4+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:56:08.633857+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 3.0.0.post4+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post5+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post5+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post5+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 is fixed in version 0.25.2.post5+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 is fixed in version 0.25.2.post5+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post5+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post7+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post7+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114095" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114096" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114098" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-47712 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-47734 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-52726 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post7+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post7+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx is fixed in version 0.25.2.post7+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post1+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42305" }, "action_statement": "Vulnerability CVE-2026-42305 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-42563" }, "action_statement": "Vulnerability CVE-2026-42563 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-47734" }, "action_statement": "Vulnerability CVE-2026-47734 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post1+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2024-3660 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-3660" }, "action_statement": "Vulnerability CVE-2024-3660 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2024-55459 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-55459" }, "action_statement": "Vulnerability CVE-2024-55459 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12058 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2025-12058" }, "action_statement": "Vulnerability CVE-2025-12058 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12060 is fixed in version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2025-12060" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-12638 is a false positive for keras 2.15.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-12638" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T07:36:45.696691+00:00", "status_notes": "Vulnerability CVE-2025-9906 does not affect version 2.15.0.post2+tuxcare of keras. keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-9906" }, "impact_statement": "keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T07:39:18.543267+00:00", "status_notes": "Vulnerability CVE-2026-0897 does not affect version 2.15.0.post2+tuxcare of keras. keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0897" }, "impact_statement": "keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-11816 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-11816" }, "action_statement": "Vulnerability CVE-2026-11816 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12479 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12479" }, "action_statement": "Vulnerability CVE-2026-12479 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12480 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12480" }, "action_statement": "Vulnerability CVE-2026-12480 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12481 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-12481" }, "action_statement": "Vulnerability CVE-2026-12481 affects version 2.15.0.post2+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12482 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12482" }, "action_statement": "Vulnerability CVE-2026-12482 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-02T07:39:18.543267+00:00", "status_notes": "Vulnerability CVE-2026-12484 does not affect version 2.15.0.post2+tuxcare of keras. keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12484" }, "impact_statement": "keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12570 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12570" }, "action_statement": "Vulnerability CVE-2026-12570 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1462 does not affect version 2.15.0.post2+tuxcare of keras. Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1462" }, "impact_statement": "Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9335 affects version 2.15.0.post2+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-9335" }, "action_statement": "Vulnerability CVE-2026-9335 affects version 2.15.0.post2+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-28jp-44vh-q42h is a false positive for keras 2.15.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-28jp-44vh-q42h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-5478-v2w6-c6q7 is a false positive for keras 2.15.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-5478-v2w6-c6q7" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/lxml@4.9.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.9.4.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:08:28.980217+00:00", "status_notes": "Vulnerability CVE-2022-2309 does not affect version 4.9.4.post1+tuxcare of lxml. CVE-2022-2309 (GHSA-wrxv-2j5q-m38w) affects lxml < 4.9.1 and was fixed upstream in 4.9.1 by 86368e9c; 4.9.4 is outside the affected range. Verified 27.10: iterwalk/c14n NULL-deref PoC segfaults vanilla lxml 4.9.0 and does not affect vanilla 4.9.4 or 4.9.4.post1+tuxcare (libxml2 2.10.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-2309" }, "impact_statement": "CVE-2022-2309 (GHSA-wrxv-2j5q-m38w) affects lxml < 4.9.1 and was fixed upstream in 4.9.1 by 86368e9c; 4.9.4 is outside the affected range. Verified 27.10: iterwalk/c14n NULL-deref PoC segfaults vanilla lxml 4.9.0 and does not affect vanilla 4.9.4 or 4.9.4.post1+tuxcare (libxml2 2.10.3)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/lxml@4.9.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/lxml@4.9.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41066 is fixed in version 4.9.4.post1+tuxcare of lxml.", "vulnerability": { "name": "CVE-2026-41066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:14:26.256716+00:00", "status_notes": "Vulnerability CVE-2023-48795 is fixed in version 3.0.0.post3+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2023-48795" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/paramiko@3.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/paramiko@3.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:14:26.256716+00:00", "status_notes": "Vulnerability CVE-2026-44405 is fixed in version 3.0.0.post3+tuxcare of paramiko.", "vulnerability": { "name": "CVE-2026-44405" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post4+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post4+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post4+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 is fixed in version 0.25.2.post4+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post4+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2024-3660 is fixed in version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2024-3660" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2024-55459 is fixed in version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2024-55459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2025-12058 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2025-12058" }, "action_statement": "Vulnerability CVE-2025-12058 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2025-12060 is fixed in version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2025-12060" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-12638 is a false positive for keras 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-12638" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2025-9906 does not affect version 2.15.0.post3+tuxcare of keras. keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-9906" }, "impact_statement": "keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-0897 does not affect version 2.15.0.post3+tuxcare of keras. keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0897" }, "impact_statement": "keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-11816 is fixed in version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-11816" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12479 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12479" }, "action_statement": "Vulnerability CVE-2026-12479 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12480 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12480" }, "action_statement": "Vulnerability CVE-2026-12480 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12481 is fixed in version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12481" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12482 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12482" }, "action_statement": "Vulnerability CVE-2026-12482 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12484 does not affect version 2.15.0.post3+tuxcare of keras. keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12484" }, "impact_statement": "keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12570 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12570" }, "action_statement": "Vulnerability CVE-2026-12570 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-1462 does not affect version 2.15.0.post3+tuxcare of keras. Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1462" }, "impact_statement": "Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-9335 affects version 2.15.0.post3+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-9335" }, "action_statement": "Vulnerability CVE-2026-9335 affects version 2.15.0.post3+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-28jp-44vh-q42h is a false positive for keras 2.15.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-28jp-44vh-q42h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-5478-v2w6-c6q7 is a false positive for keras 2.15.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-5478-v2w6-c6q7" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post2+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42305" }, "action_statement": "Vulnerability CVE-2026-42305 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-47734" }, "action_statement": "Vulnerability CVE-2026-47734 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post2+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2024-3660 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-3660" }, "action_statement": "Vulnerability CVE-2024-3660 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2024-55459 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-55459" }, "action_statement": "Vulnerability CVE-2024-55459 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12058 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2025-12058" }, "action_statement": "Vulnerability CVE-2025-12058 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-12060 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-12060" }, "action_statement": "Vulnerability CVE-2025-12060 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2025-12638 is a false positive for keras 2.15.0.post1+tuxcare.", "vulnerability": { "name": "CVE-2025-12638" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T07:36:45.696691+00:00", "status_notes": "Vulnerability CVE-2025-9906 does not affect version 2.15.0.post1+tuxcare of keras. keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-9906" }, "impact_statement": "keras 2.15.0: vulnerable API (keras.config.enable_unsafe_deserialization / KerasSaveable, keras 3.0-3.10) absent in 2.x; malicious .keras gadget fails with TypeError. esultanaliev 2026-10-02" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T07:39:18.543267+00:00", "status_notes": "Vulnerability CVE-2026-0897 does not affect version 2.15.0.post1+tuxcare of keras. keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0897" }, "impact_statement": "keras 2.15.0: fix is in KerasFileEditor (keras/src/saving/file_editor.py), module absent in 2.x. esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-11816 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-11816" }, "action_statement": "Vulnerability CVE-2026-11816 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12479 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12479" }, "action_statement": "Vulnerability CVE-2026-12479 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12480 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12480" }, "action_statement": "Vulnerability CVE-2026-12480 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T08:02:59.966216+00:00", "status_notes": "Vulnerability CVE-2026-12481 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-12481" }, "action_statement": "Vulnerability CVE-2026-12481 affects version 2.15.0.post1+tuxcare of keras, and is fixed in 2.15.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12482 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12482" }, "action_statement": "Vulnerability CVE-2026-12482 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-02T07:39:18.543267+00:00", "status_notes": "Vulnerability CVE-2026-12484 does not affect version 2.15.0.post1+tuxcare of keras. keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-12484" }, "impact_statement": "keras 2.15.0: TorchModuleWrapper absent in 2.x (TF-only). esultanaliev 2026-10-02" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-12570 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-12570" }, "action_statement": "Vulnerability CVE-2026-12570 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1462 does not affect version 2.15.0.post1+tuxcare of keras. Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-1462" }, "impact_statement": "Not applicable to keras 2.15.0: TFSMLayer was introduced in Keras 3.x; class and file (keras/src/export/tfsm_layer.py) do not exist in 2.x line. Per NVD, scoped to keras 3.13.0. Ref: https://nvd.nist.gov/vuln/detail/CVE-2026-1462" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9335 affects version 2.15.0.post1+tuxcare of keras.", "vulnerability": { "name": "CVE-2026-9335" }, "action_statement": "Vulnerability CVE-2026-9335 affects version 2.15.0.post1+tuxcare of keras." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-28jp-44vh-q42h is a false positive for keras 2.15.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-28jp-44vh-q42h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/keras@2.15.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/keras@2.15.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-5478-v2w6-c6q7 is a false positive for keras 2.15.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-5478-v2w6-c6q7" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10554 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "AIKIDO-2026-10554" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:09:44.771182+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:09:49.742330+00:00", "status_notes": "Vulnerability CVE-2026-114096 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114096" }, "action_statement": "Vulnerability CVE-2026-114096 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:09:58.037684+00:00", "status_notes": "Vulnerability CVE-2026-114097 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114097" }, "action_statement": "Vulnerability CVE-2026-114097 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:10:14.450797+00:00", "status_notes": "Vulnerability CVE-2026-114098 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-114098" }, "action_statement": "Vulnerability CVE-2026-114098 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42563 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47712 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47734 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-52726 is fixed in version 0.25.2.post6+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "action_statement": "Vulnerability GHSA-5fqc-mrg8-w798 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-08T06:50:00.098485+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "action_statement": "Vulnerability GHSA-8w8g-wq8h-fq33 affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.25.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.25.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare.", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "action_statement": "Vulnerability GHSA-cm62-gvxx-vmxx affects version 0.25.2.post6+tuxcare of dulwich, and is fixed in 0.25.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-40267" }, "action_statement": "Vulnerability CVE-2023-40267 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-76220" }, "action_statement": "Vulnerability CVE-2026-76220 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" }, "action_statement": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" }, "action_statement": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-p538-c434-8v24" }, "action_statement": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" }, "action_statement": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post3+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post3+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" }, "action_statement": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post3+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post7+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post7+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post7+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-40267" }, "action_statement": "Vulnerability CVE-2023-40267 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42215" }, "action_statement": "Vulnerability CVE-2026-42215 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-76220" }, "action_statement": "Vulnerability CVE-2026-76220 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" }, "action_statement": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" }, "action_statement": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" }, "action_statement": "Vulnerability GHSA-mv93-w799-cj2w affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-p538-c434-8v24" }, "action_statement": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" }, "action_statement": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post2+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post2+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post2+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" }, "action_statement": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post2+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2024-5629 is fixed in version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2024-5629" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability CVE-2026-106435 affects version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-106435" }, "action_statement": "Vulnerability CVE-2026-106435 affects version 3.13.0.post2+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-88029 affects version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-88029" }, "action_statement": "Vulnerability CVE-2026-88029 affects version 3.13.0.post2+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-96747 affects version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96747" }, "action_statement": "Vulnerability CVE-2026-96747 affects version 3.13.0.post2+tuxcare of pymongo." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-96748 is fixed in version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96748" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-96749 is fixed in version 3.13.0.post2+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96749" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability GHSA-86gh-39m5-hhg6 is a false positive for pymongo 3.13.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-86gh-39m5-hhg6" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-8h2c-ghff-mpg9 is a false positive for pymongo 3.13.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-8h2c-ghff-mpg9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-cr6f-gf5w-vhrc is a false positive for pymongo 3.13.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-cr6f-gf5w-vhrc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post12+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post12+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post12+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post12+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-110855 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-110856 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110856" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-110857 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110857" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-110858 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110858" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-110859 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110859" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-114145" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-42284 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42284" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-44243 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-87817 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability CVE-2026-87819 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87819" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post17+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post17+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:41:00.088058+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post17+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dnspython@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dnspython@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29483 affects version 2.3.0.post1+tuxcare of dnspython, and is fixed in 2.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-29483" }, "action_statement": "Vulnerability CVE-2023-29483 affects version 2.3.0.post1+tuxcare of dnspython, and is fixed in 2.3.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dnspython@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dnspython@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:48:16.904261+00:00", "status_notes": "Vulnerability CVE-2026-114605 affects version 2.3.0.post1+tuxcare of dnspython.", "vulnerability": { "name": "CVE-2026-114605" }, "action_statement": "Vulnerability CVE-2026-114605 affects version 2.3.0.post1+tuxcare of dnspython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" }, "action_statement": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-p538-c434-8v24" }, "action_statement": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post4+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post4+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post4+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post11+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post11+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post11+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post8+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post8+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post8+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-5629 is fixed in version 3.13.0.post1+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2024-5629" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability CVE-2026-106435 affects version 3.13.0.post1+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-106435" }, "action_statement": "Vulnerability CVE-2026-106435 affects version 3.13.0.post1+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-88029 affects version 3.13.0.post1+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-88029" }, "action_statement": "Vulnerability CVE-2026-88029 affects version 3.13.0.post1+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-96747 affects version 3.13.0.post1+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96747" }, "action_statement": "Vulnerability CVE-2026-96747 affects version 3.13.0.post1+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-96748 affects version 3.13.0.post1+tuxcare of pymongo, and is fixed in 3.13.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-96748" }, "action_statement": "Vulnerability CVE-2026-96748 affects version 3.13.0.post1+tuxcare of pymongo, and is fixed in 3.13.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-19T07:58:00.136730+00:00", "status_notes": "Vulnerability CVE-2026-96749 affects version 3.13.0.post1+tuxcare of pymongo, and is fixed in 3.13.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-96749" }, "action_statement": "Vulnerability CVE-2026-96749 affects version 3.13.0.post1+tuxcare of pymongo, and is fixed in 3.13.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability GHSA-86gh-39m5-hhg6 is a false positive for pymongo 3.13.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-86gh-39m5-hhg6" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-8h2c-ghff-mpg9 is a false positive for pymongo 3.13.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-8h2c-ghff-mpg9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-cr6f-gf5w-vhrc is a false positive for pymongo 3.13.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-cr6f-gf5w-vhrc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-40267" }, "action_statement": "Vulnerability CVE-2023-40267 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42215" }, "action_statement": "Vulnerability CVE-2026-42215 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-44244" }, "action_statement": "Vulnerability CVE-2026-44244 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-76220" }, "action_statement": "Vulnerability CVE-2026-76220 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" }, "action_statement": "Vulnerability GHSA-539m-9xh6-q6rr affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" }, "action_statement": "Vulnerability GHSA-6p8h-3wgx-97gf affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" }, "action_statement": "Vulnerability GHSA-mv93-w799-cj2w affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-p538-c434-8v24" }, "action_statement": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" }, "action_statement": "Vulnerability GHSA-r9mr-m37c-5fr3 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post1+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post1+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post1+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" }, "action_statement": "Vulnerability GHSA-wvpp-8hx9-p66j affects version 3.1.31.post1+tuxcare of gitpython, and is fixed in 3.1.31.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post6+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post6+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post6+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110855 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110856 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110856" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110857" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110858 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110858" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110859 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110859" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post16+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post16+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-42284 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42284" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-44243 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-87817 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-87819 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87819" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post16+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post16+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post16+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42284" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post13+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post13+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post13+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post13+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post9+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post9+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post9+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post9+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post10+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post10+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post10+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post14+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-42284 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42284" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-44243 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87819" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post14+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post14+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post14+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2023-40590 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40590" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2024-22190 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2024-22190" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110856" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post15+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post15+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110858" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-110859" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post15+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post15+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-42284 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42284" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-44243 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-67322 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67322" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-67323 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-67325 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-67325" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-69097" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-76217 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-76218 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76218" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-76219 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76219" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-76222 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76222" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-78675 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78675" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-78676 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78676" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-78677 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78677" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-78678 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78678" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-78679 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-78679" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-87817 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-87819 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-87819" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-p538-c434-8v24" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post15+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post15+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post15+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:20:21.142399+00:00", "status_notes": "Vulnerability CVE-2024-5629 is fixed in version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2024-5629" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability CVE-2026-106435 affects version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-106435" }, "action_statement": "Vulnerability CVE-2026-106435 affects version 3.13.0.post3+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:20:21.142399+00:00", "status_notes": "Vulnerability CVE-2026-88029 affects version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-88029" }, "action_statement": "Vulnerability CVE-2026-88029 affects version 3.13.0.post3+tuxcare of pymongo." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:20:21.142399+00:00", "status_notes": "Vulnerability CVE-2026-96747 affects version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96747" }, "action_statement": "Vulnerability CVE-2026-96747 affects version 3.13.0.post3+tuxcare of pymongo." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:20:21.142399+00:00", "status_notes": "Vulnerability CVE-2026-96748 is fixed in version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96748" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:20:21.142399+00:00", "status_notes": "Vulnerability CVE-2026-96749 is fixed in version 3.13.0.post3+tuxcare of pymongo.", "vulnerability": { "name": "CVE-2026-96749" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T15:43:28.063170+00:00", "status_notes": "Vulnerability GHSA-86gh-39m5-hhg6 is a false positive for pymongo 3.13.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-86gh-39m5-hhg6" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-8h2c-ghff-mpg9 is a false positive for pymongo 3.13.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-8h2c-ghff-mpg9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pymongo@3.13.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pymongo@3.13.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-cr6f-gf5w-vhrc is a false positive for pymongo 3.13.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-cr6f-gf5w-vhrc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dnspython@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dnspython@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29483 is fixed in version 2.3.0.post2+tuxcare of dnspython.", "vulnerability": { "name": "CVE-2023-29483" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dnspython@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dnspython@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T15:48:16.904261+00:00", "status_notes": "Vulnerability CVE-2026-114605 affects version 2.3.0.post2+tuxcare of dnspython.", "vulnerability": { "name": "CVE-2026-114605" }, "action_statement": "Vulnerability CVE-2026-114605 affects version 2.3.0.post2+tuxcare of dnspython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40267 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-40267" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-40590 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-40590" }, "action_statement": "Vulnerability CVE-2023-40590 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-41040 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2023-41040" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22190 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-22190" }, "action_statement": "Vulnerability CVE-2024-22190 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110855 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110855" }, "action_statement": "Vulnerability CVE-2026-110855 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110856 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110856" }, "action_statement": "Vulnerability CVE-2026-110856 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T07:19:00.116705+00:00", "status_notes": "Vulnerability CVE-2026-110857 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-110857" }, "action_statement": "Vulnerability CVE-2026-110857 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110858 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110858" }, "action_statement": "Vulnerability CVE-2026-110858 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:51:00.223505+00:00", "status_notes": "Vulnerability CVE-2026-110859 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-110859" }, "action_statement": "Vulnerability CVE-2026-110859 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:41:44.104306+00:00", "status_notes": "Vulnerability CVE-2026-114145 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-114145" }, "action_statement": "Vulnerability CVE-2026-114145 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42215 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-42215" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42284 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-42284" }, "action_statement": "Vulnerability CVE-2026-42284 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44243 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-44243" }, "action_statement": "Vulnerability CVE-2026-44243 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44244 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-44244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67322 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67322" }, "action_statement": "Vulnerability CVE-2026-67322 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67323 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67323" }, "action_statement": "Vulnerability CVE-2026-67323 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67325 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-67325" }, "action_statement": "Vulnerability CVE-2026-67325 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability CVE-2026-69097 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-69097" }, "action_statement": "Vulnerability CVE-2026-69097 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76217 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76217" }, "action_statement": "Vulnerability CVE-2026-76217 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76218 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-76218" }, "action_statement": "Vulnerability CVE-2026-76218 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76219 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-76219" }, "action_statement": "Vulnerability CVE-2026-76219 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76220 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "CVE-2026-76220" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-76222 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-76222" }, "action_statement": "Vulnerability CVE-2026-76222 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78675 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78675" }, "action_statement": "Vulnerability CVE-2026-78675 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78676 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78676" }, "action_statement": "Vulnerability CVE-2026-78676 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78677 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78677" }, "action_statement": "Vulnerability CVE-2026-78677 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78678 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78678" }, "action_statement": "Vulnerability CVE-2026-78678 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-78679 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-78679" }, "action_statement": "Vulnerability CVE-2026-78679 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87817 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87817" }, "action_statement": "Vulnerability CVE-2026-87817 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability CVE-2026-87819 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-87819" }, "action_statement": "Vulnerability CVE-2026-87819 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:39:00.143318+00:00", "status_notes": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-23mf-xhv8-69c2" }, "action_statement": "Vulnerability GHSA-23mf-xhv8-69c2 affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-298h-jpq4-m665 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-298h-jpq4-m665" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-2f96-g7mh-g2hx" }, "action_statement": "Vulnerability GHSA-2f96-g7mh-g2hx affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-2pxq-5vcg-rq29 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-2pxq-5vcg-rq29" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3f7w-8rr8-f37f" }, "action_statement": "Vulnerability GHSA-3f7w-8rr8-f37f affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-3rp5-jjmw-4wv2" }, "action_statement": "Vulnerability GHSA-3rp5-jjmw-4wv2 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-3vrx-526r-64rm is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-3vrx-526r-64rm" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-4gmw-gg2m-w46p" }, "action_statement": "Vulnerability GHSA-4gmw-gg2m-w46p affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-4vpg-pfj8-m33q is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-4vpg-pfj8-m33q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-539m-9xh6-q6rr is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-539m-9xh6-q6rr" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:46:00.077951+00:00", "status_notes": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare.", "vulnerability": { "name": "GHSA-59cr-6r3x-644w" }, "action_statement": "Vulnerability GHSA-59cr-6r3x-644w affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-6p8h-3wgx-97gf is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-6p8h-3wgx-97gf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6r2r-ww24-7h52 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-6r2r-ww24-7h52" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-6rj2-96f5-chj9 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-6rj2-96f5-chj9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7jx3-jqcp-hhgc is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-7jx3-jqcp-hhgc" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-7r39-6q8m-qw68 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-7r39-6q8m-qw68" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-89ff-m8wv-p99r is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-89ff-m8wv-p99r" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-94p4-4cq8-9g67" }, "action_statement": "Vulnerability GHSA-94p4-4cq8-9g67 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-9557-234j-7rv9 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-9557-234j-7rv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-956x-8gvw-wg5v" }, "action_statement": "Vulnerability GHSA-956x-8gvw-wg5v affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-9rj7-rf2p-w77r" }, "action_statement": "Vulnerability GHSA-9rj7-rf2p-w77r affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-23T21:56:02.416784+00:00", "status_notes": "Vulnerability GHSA-9xx9-hw38-h2w9 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-9xx9-hw38-h2w9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-crmc-f4m7-33fj is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-crmc-f4m7-33fj" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-f9j4-qggq-h239" }, "action_statement": "Vulnerability GHSA-f9j4-qggq-h239 affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-fjr4-x663-mwxc" }, "action_statement": "Vulnerability GHSA-fjr4-x663-mwxc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-fx3j-rwgx-fr94" }, "action_statement": "Vulnerability GHSA-fx3j-rwgx-fr94 affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-gq48-pqfc-9p58" }, "action_statement": "Vulnerability GHSA-gq48-pqfc-9p58 affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare.", "vulnerability": { "name": "GHSA-hh9p-6wh2-4mfc" }, "action_statement": "Vulnerability GHSA-hh9p-6wh2-4mfc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare.", "vulnerability": { "name": "GHSA-hmq2-w58f-27jc" }, "action_statement": "Vulnerability GHSA-hmq2-w58f-27jc affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare.", "vulnerability": { "name": "GHSA-jm78-9fvv-mhgr" }, "action_statement": "Vulnerability GHSA-jm78-9fvv-mhgr affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-m4f3-g4cq-hqrx is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-m4f3-g4cq-hqrx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-m64x-33q8-m5h7" }, "action_statement": "Vulnerability GHSA-m64x-33q8-m5h7 affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mv93-w799-cj2w is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-mv93-w799-cj2w" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare.", "vulnerability": { "name": "GHSA-p538-c434-8v24" }, "action_statement": "Vulnerability GHSA-p538-c434-8v24 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-qpf5-3wfw-fh7q is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-qpf5-3wfw-fh7q" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-r9mr-m37c-5fr3 is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-r9mr-m37c-5fr3" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare.", "vulnerability": { "name": "GHSA-rwj8-pgh3-r573" }, "action_statement": "Vulnerability GHSA-rwj8-pgh3-r573 affects version 3.1.31.post5+tuxcare of gitpython, and is fixed in 3.1.31.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-w672-239g-c3gr is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-w672-239g-c3gr" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-27T15:33:28.003963+00:00", "status_notes": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-w8jc-g24h-crhw" }, "action_statement": "Vulnerability GHSA-w8jc-g24h-crhw affects version 3.1.31.post5+tuxcare of gitpython." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-wv46-xpj8-pw53 is a false positive for gitpython 3.1.31.post5+tuxcare.", "vulnerability": { "name": "GHSA-wv46-xpj8-pw53" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gitpython@3.1.31.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/gitpython@3.1.31.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wvpp-8hx9-p66j is fixed in version 3.1.31.post5+tuxcare of gitpython.", "vulnerability": { "name": "GHSA-wvpp-8hx9-p66j" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post1+tuxcare of virtualenv.", "vulnerability": { "name": "AIKIDO-2026-10495" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102925 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-102925" }, "action_statement": "Vulnerability CVE-2026-102925 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102930 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-102930" }, "action_statement": "Vulnerability CVE-2026-102930 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102937 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-102937" }, "action_statement": "Vulnerability CVE-2026-102937 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102938 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-102938" }, "action_statement": "Vulnerability CVE-2026-102938 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-113713 affects version 20.39.1.post1+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113713" }, "action_statement": "Vulnerability CVE-2026-113713 affects version 20.39.1.post1+tuxcare of virtualenv." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113714 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113714" }, "action_statement": "Vulnerability CVE-2026-113714 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113715 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113715" }, "action_statement": "Vulnerability CVE-2026-113715 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113716 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113716" }, "action_statement": "Vulnerability CVE-2026-113716 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113717 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113717" }, "action_statement": "Vulnerability CVE-2026-113717 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T22:50:18.455196+00:00", "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post1+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113718" }, "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113719 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113719" }, "action_statement": "Vulnerability CVE-2026-113719 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113720 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113720" }, "action_statement": "Vulnerability CVE-2026-113720 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113721 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113721" }, "action_statement": "Vulnerability CVE-2026-113721 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113722 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113722" }, "action_statement": "Vulnerability CVE-2026-113722 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113723 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113723" }, "action_statement": "Vulnerability CVE-2026-113723 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post1+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113724" }, "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T07:15:15.426797+00:00", "status_notes": "Vulnerability CVE-2026-113725 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113725" }, "action_statement": "Vulnerability CVE-2026-113725 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113726 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113726" }, "action_statement": "Vulnerability CVE-2026-113726 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113732 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113732" }, "action_statement": "Vulnerability CVE-2026-113732 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:53:00.109738+00:00", "status_notes": "Vulnerability CVE-2026-113776 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113776" }, "action_statement": "Vulnerability CVE-2026-113776 affects version 20.39.1.post1+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-115586 affects version 20.39.1.post1+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-115586" }, "action_statement": "Vulnerability CVE-2026-115586 affects version 20.39.1.post1+tuxcare of virtualenv." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "AIKIDO-2026-10495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102925" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102930" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:40:23.921263+00:00", "status_notes": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102938" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-113713 affects version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113713" }, "action_statement": "Vulnerability CVE-2026-113713 affects version 20.39.1.post2+tuxcare of virtualenv." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113714 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113714" }, "action_statement": "Vulnerability CVE-2026-113714 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113715 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113715" }, "action_statement": "Vulnerability CVE-2026-113715 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113716 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113716" }, "action_statement": "Vulnerability CVE-2026-113716 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113717 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113717" }, "action_statement": "Vulnerability CVE-2026-113717 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T22:50:18.455196+00:00", "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post2+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113718" }, "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113719 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113719" }, "action_statement": "Vulnerability CVE-2026-113719 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113720 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113720" }, "action_statement": "Vulnerability CVE-2026-113720 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113721 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113721" }, "action_statement": "Vulnerability CVE-2026-113721 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113722 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113722" }, "action_statement": "Vulnerability CVE-2026-113722 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113723 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113723" }, "action_statement": "Vulnerability CVE-2026-113723 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post2+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113724" }, "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T07:15:15.426797+00:00", "status_notes": "Vulnerability CVE-2026-113725 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113725" }, "action_statement": "Vulnerability CVE-2026-113725 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113726 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113726" }, "action_statement": "Vulnerability CVE-2026-113726 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113732 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113732" }, "action_statement": "Vulnerability CVE-2026-113732 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:53:00.109738+00:00", "status_notes": "Vulnerability CVE-2026-113776 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-113776" }, "action_statement": "Vulnerability CVE-2026-113776 affects version 20.39.1.post2+tuxcare of virtualenv, and is fixed in 20.39.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-115586 affects version 20.39.1.post2+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-115586" }, "action_statement": "Vulnerability CVE-2026-115586 affects version 20.39.1.post2+tuxcare of virtualenv." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post5+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post5+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post5+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post5+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post5+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.27.0.post5+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.27.0.post5+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post5+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post5+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post24+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post24+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post24+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post24+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post24+tuxcare" } } ], "timestamp": "2026-10-08T11:04:10.657905+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post24+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post2+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.4.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 affects version 1.1.4.post2+tuxcare of flask, and is fixed in 1.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27205" }, "action_statement": "Vulnerability CVE-2026-27205 affects version 1.1.4.post2+tuxcare of flask, and is fixed in 1.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45452" }, "action_statement": "Vulnerability CVE-2021-45452 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22818" }, "action_statement": "Vulnerability CVE-2022-22818 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post2+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post2+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 2.2.1.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 2.2.1.post1+tuxcare of flask." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-30861 affects version 2.2.1.post1+tuxcare of flask, and is fixed in 2.2.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-30861" }, "action_statement": "Vulnerability CVE-2023-30861 affects version 2.2.1.post1+tuxcare of flask, and is fixed in 2.2.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 affects version 2.2.1.post1+tuxcare of flask, and is fixed in 2.2.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-27205" }, "action_statement": "Vulnerability CVE-2026-27205 affects version 2.2.1.post1+tuxcare of flask, and is fixed in 2.2.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post4+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post4+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-08T06:30:19.733240+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.4.post4+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-08T06:30:19.733240+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 1.1.4.post4+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post10+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post10+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post10+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-05T11:35:00.259970+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post10+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post10+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.25.0.post2+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.25.0.post2+tuxcare of starlette. CVE-2025-62727 is a Range header parsing flaw in FileResponse. That parsing was introduced upstream in starlette 0.39.0; version 0.25.0 predates it. Verified on tuxcare-current/0.25.0: the string \"Range\" does not occur anywhere in the starlette package, and FileResponse implements no range handling. Same disposition and same reasoning as starlette 0.27.0 (VPV 81209), which is already not_affected with justification code_not_present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "CVE-2025-62727 is a Range header parsing flaw in FileResponse. That parsing was introduced upstream in starlette 0.39.0; version 0.25.0 predates it. Verified on tuxcare-current/0.25.0: the string \"Range\" does not occur anywhere in the starlette package, and FileResponse implements no range handling. Same disposition and same reasoning as starlette 0.27.0 (VPV 81209), which is already not_affected with justification code_not_present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.25.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.25.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.25.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2023.7.22.post2+tuxcare of certifi.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2023.7.22.post2+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-37920 affects version 2023.7.22.post2+tuxcare of certifi.", "vulnerability": { "name": "CVE-2023-37920" }, "action_statement": "Vulnerability CVE-2023-37920 affects version 2023.7.22.post2+tuxcare of certifi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 is fixed in version 2023.7.22.post2+tuxcare of certifi.", "vulnerability": { "name": "CVE-2024-39689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post2+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2023.7.22.post2+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2023.7.22.post2+tuxcare of certifi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post10+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post10+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post8+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post8+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-10742 is fixed in version 23.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2026-10742" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-1135 affects version 23.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" }, "action_statement": "Vulnerability CVE-2024-1135 affects version 23.0.0.post1+tuxcare of gunicorn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@23.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-6827 affects version 23.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" }, "action_statement": "Vulnerability CVE-2024-6827 affects version 23.0.0.post1+tuxcare of gunicorn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post7+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post7+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post7+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post7+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post7+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post7+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post7+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post7+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22818" }, "action_statement": "Vulnerability CVE-2022-22818 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post4+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post4+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post6+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post6+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post6+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post6+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post6+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post6+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47248 is fixed in version 12.0.1.post1+tuxcare of pyarrow.", "vulnerability": { "name": "CVE-2023-47248" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-25087 affects version 12.0.1.post1+tuxcare of pyarrow.", "vulnerability": { "name": "CVE-2026-25087" }, "action_statement": "Vulnerability CVE-2026-25087 affects version 12.0.1.post1+tuxcare of pyarrow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyarrow@12.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T08:36:00.190910+00:00", "status_notes": "Vulnerability CVE-2026-92287 affects version 12.0.1.post1+tuxcare of pyarrow.", "vulnerability": { "name": "CVE-2026-92287" }, "action_statement": "Vulnerability CVE-2026-92287 affects version 12.0.1.post1+tuxcare of pyarrow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post2+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post2+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post2+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post2+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.27.0.post2+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post1+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post1+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-54121" }, "action_statement": "Vulnerability CVE-2025-54121 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post1+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48710" }, "action_statement": "Vulnerability CVE-2026-48710 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.27.0.post1+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post7+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post7+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post7+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post7+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post7+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post14+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post14+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post7+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post7+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2021-32677 affects version 0.104.1.post3+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" }, "action_statement": "Vulnerability CVE-2021-32677 affects version 0.104.1.post3+tuxcare of fastapi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.104.1.post3+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.104.1.post3+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post6+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post6+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post6+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post6+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2021-32677 affects version 0.104.1.post2+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" }, "action_statement": "Vulnerability CVE-2021-32677 affects version 0.104.1.post2+tuxcare of fastapi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.104.1.post2+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.104.1.post2+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 2.2.5.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 2.2.5.post1+tuxcare of flask." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-30861 affects version 2.2.5.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" }, "action_statement": "Vulnerability CVE-2023-30861 affects version 2.2.5.post1+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 2.2.5.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post11+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post11+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post16+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post16+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2022.12.7.post3+tuxcare of certifi.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2022.12.7.post3+tuxcare of certifi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37920 is fixed in version 2022.12.7.post3+tuxcare of certifi.", "vulnerability": { "name": "CVE-2023-37920" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 is fixed in version 2022.12.7.post3+tuxcare of certifi.", "vulnerability": { "name": "CVE-2024-39689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post3+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2022.12.7.post3+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2022.12.7.post3+tuxcare of certifi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post9+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post9+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post9+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post9+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post9+tuxcare" } } ], "timestamp": "2026-10-06T10:22:24.069948+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.25.11.post9+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post13+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post13+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post3+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post3+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post3+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post3+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48817" }, "action_statement": "Vulnerability CVE-2026-48817 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-48818" }, "action_statement": "Vulnerability CVE-2026-48818 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.27.0.post3+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post25+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post25+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post25+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post25+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post25+tuxcare" } } ], "timestamp": "2026-10-09T10:13:00.225381+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post25+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post17+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post17+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post17+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post20+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post20+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post20+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.2.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.2.post2+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.2.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 1.1.2.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "AIKIDO-2026-10495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102925" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102930" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102938" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-113713 affects version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113713" }, "action_statement": "Vulnerability CVE-2026-113713 affects version 20.39.1.post5+tuxcare of virtualenv." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113714 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113714" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113715 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113715" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113716 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113716" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113717 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113717" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post5+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113718" }, "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113719 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113719" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113720 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113720" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113721 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113721" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113722 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113722" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113723 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113723" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post5+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113724" }, "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113725 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113726 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113726" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113732 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113732" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T13:20:56.941930+00:00", "status_notes": "Vulnerability CVE-2026-113776 is fixed in version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113776" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-115586 affects version 20.39.1.post5+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-115586" }, "action_statement": "Vulnerability CVE-2026-115586 affects version 20.39.1.post5+tuxcare of virtualenv." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post23+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post23+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post23+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post23+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post23+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 2.2.1.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 2.2.1.post2+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 2.2.1.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@2.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 2.2.1.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post4+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post4+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-24762" }, "action_statement": "Vulnerability CVE-2024-24762 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post4+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post4+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54282" }, "action_statement": "Vulnerability CVE-2026-54282 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54283" }, "action_statement": "Vulnerability CVE-2026-54283 affects version 0.27.0.post4+tuxcare of starlette, and is fixed in 0.27.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45452" }, "action_statement": "Vulnerability CVE-2021-45452 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22818" }, "action_statement": "Vulnerability CVE-2022-22818 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post1+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post1+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2022.12.7.post1+tuxcare of certifi.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2022.12.7.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-37920 affects version 2022.12.7.post1+tuxcare of certifi, and is fixed in 2022.12.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-37920" }, "action_statement": "Vulnerability CVE-2023-37920 affects version 2022.12.7.post1+tuxcare of certifi, and is fixed in 2022.12.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 affects version 2022.12.7.post1+tuxcare of certifi, and is fixed in 2022.12.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-39689" }, "action_statement": "Vulnerability CVE-2024-39689 affects version 2022.12.7.post1+tuxcare of certifi, and is fixed in 2022.12.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2022.12.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2022.12.7.post1+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2022.12.7.post1+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2022.12.7.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post1+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.4.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 affects version 1.1.4.post1+tuxcare of flask, and is fixed in 1.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27205" }, "action_statement": "Vulnerability CVE-2026-27205 affects version 1.1.4.post1+tuxcare of flask, and is fixed in 1.1.4.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post21+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post21+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post21+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post21+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post21+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post21+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2022-23491 affects version 2023.7.22.post1+tuxcare of certifi.", "vulnerability": { "name": "CVE-2022-23491" }, "action_statement": "Vulnerability CVE-2022-23491 affects version 2023.7.22.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-37920 affects version 2023.7.22.post1+tuxcare of certifi.", "vulnerability": { "name": "CVE-2023-37920" }, "action_statement": "Vulnerability CVE-2023-37920 affects version 2023.7.22.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39689 affects version 2023.7.22.post1+tuxcare of certifi, and is fixed in 2023.7.22.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-39689" }, "action_statement": "Vulnerability CVE-2024-39689 affects version 2023.7.22.post1+tuxcare of certifi, and is fixed in 2023.7.22.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/certifi@2023.7.22.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/certifi@2023.7.22.post1+tuxcare" } } ], "timestamp": "2026-10-20T19:41:00.116459+00:00", "status_notes": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2023.7.22.post1+tuxcare of certifi.", "vulnerability": { "name": "GHSA-6q48-6c7w-9gw2" }, "action_statement": "Vulnerability GHSA-6q48-6c7w-9gw2 affects version 2023.7.22.post1+tuxcare of certifi." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54275 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54275" }, "action_statement": "Vulnerability CVE-2026-54275 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54276 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54276" }, "action_statement": "Vulnerability CVE-2026-54276 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.10.11.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.10.11.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/scikit-learn@1.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/scikit-learn@1.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-28975 affects version 1.0.2.post2+tuxcare of scikit-learn.", "vulnerability": { "name": "CVE-2020-28975" }, "action_statement": "Vulnerability CVE-2020-28975 affects version 1.0.2.post2+tuxcare of scikit-learn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/scikit-learn@1.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/scikit-learn@1.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-5206 is fixed in version 1.0.2.post2+tuxcare of scikit-learn.", "vulnerability": { "name": "CVE-2024-5206" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37891" }, "action_statement": "Vulnerability CVE-2024-37891 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-50181" }, "action_statement": "Vulnerability CVE-2025-50181 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post2+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post12+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post12+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 2.2.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 2.2.5.post2+tuxcare of flask." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-30861 affects version 2.2.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" }, "action_statement": "Vulnerability CVE-2023-30861 affects version 2.2.5.post2+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@2.2.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@2.2.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T07:35:04.306683+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 2.2.5.post2+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.2.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.2.post1+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.2.post1+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 affects version 1.1.2.post1+tuxcare of flask, and is fixed in 1.1.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-27205" }, "action_statement": "Vulnerability CVE-2026-27205 affects version 1.1.2.post1+tuxcare of flask, and is fixed in 1.1.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-42563 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" }, "action_statement": "Vulnerability CVE-2026-42563 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-47734 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" }, "action_statement": "Vulnerability CVE-2026-47734 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post2+tuxcare of dulwich." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "impact_statement": "GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf is fixed in version 0.21.7.post2+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "impact_statement": "GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx does not affect version 0.21.7.post2+tuxcare of dulwich. GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "impact_statement": "GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-09T07:18:00.126700+00:00", "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "AIKIDO-2026-10495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-09T07:18:00.126700+00:00", "status_notes": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102925" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-09T07:18:00.126700+00:00", "status_notes": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102930" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-09T07:18:00.126700+00:00", "status_notes": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-09T07:18:00.126700+00:00", "status_notes": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102938" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-113713 affects version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113713" }, "action_statement": "Vulnerability CVE-2026-113713 affects version 20.39.1.post3+tuxcare of virtualenv." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113714 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113714" }, "action_statement": "Vulnerability CVE-2026-113714 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113715 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113715" }, "action_statement": "Vulnerability CVE-2026-113715 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113716 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113716" }, "action_statement": "Vulnerability CVE-2026-113716 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113717 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113717" }, "action_statement": "Vulnerability CVE-2026-113717 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T22:50:18.455196+00:00", "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post3+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113718" }, "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113719 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113719" }, "action_statement": "Vulnerability CVE-2026-113719 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113720 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113720" }, "action_statement": "Vulnerability CVE-2026-113720 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113721 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113721" }, "action_statement": "Vulnerability CVE-2026-113721 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113722 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113722" }, "action_statement": "Vulnerability CVE-2026-113722 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113723 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113723" }, "action_statement": "Vulnerability CVE-2026-113723 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post3+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113724" }, "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T07:15:15.426797+00:00", "status_notes": "Vulnerability CVE-2026-113725 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-113725" }, "action_statement": "Vulnerability CVE-2026-113725 affects version 20.39.1.post3+tuxcare of virtualenv, and is fixed in 20.39.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113726 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113726" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:54:00.184154+00:00", "status_notes": "Vulnerability CVE-2026-113732 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113732" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:53:00.109738+00:00", "status_notes": "Vulnerability CVE-2026-113776 is fixed in version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113776" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-115586 affects version 20.39.1.post3+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-115586" }, "action_statement": "Vulnerability CVE-2026-115586 affects version 20.39.1.post3+tuxcare of virtualenv." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post22+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post22+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post22+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post22+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post22+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post22+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post22+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post22+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post22+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post19+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post19+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post19+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-45452" }, "action_statement": "Vulnerability CVE-2021-45452 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22818" }, "action_statement": "Vulnerability CVE-2022-22818 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post3+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post3+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post18+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post18+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post18+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post6+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post6+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37891" }, "action_statement": "Vulnerability CVE-2024-37891 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post3+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post3+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability AIKIDO-2026-10495 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "AIKIDO-2026-10495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-102925 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102925" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-102930 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102930" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-102937 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102937" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-102938 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-102938" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-113713 affects version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113713" }, "action_statement": "Vulnerability CVE-2026-113713 affects version 20.39.1.post4+tuxcare of virtualenv." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113714 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113714" }, "action_statement": "Vulnerability CVE-2026-113714 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113715 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113715" }, "action_statement": "Vulnerability CVE-2026-113715 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113716 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113716" }, "action_statement": "Vulnerability CVE-2026-113716 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:20.563263+00:00", "status_notes": "Vulnerability CVE-2026-113717 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113717" }, "action_statement": "Vulnerability CVE-2026-113717 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T22:50:18.455196+00:00", "status_notes": "Vulnerability CVE-2026-113718 does not affect version 20.39.1.post4+tuxcare of virtualenv. not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113718" }, "impact_statement": "not_affected \u2014 CVE-2026-113718 concerns code injection in virtualenv's xonsh activation script generation through multibyte encoding confusion. The xonsh activator module was completely removed from virtualenv in version 20.7.0 (July 2021, commit 1afc1900). The target version 20.39.1 is significantly later and does not contain any xonsh activation code. Exhaustive searches confirm the vulnerable code path doe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113719 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113719" }, "action_statement": "Vulnerability CVE-2026-113719 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:32.362993+00:00", "status_notes": "Vulnerability CVE-2026-113720 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113720" }, "action_statement": "Vulnerability CVE-2026-113720 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113721 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113721" }, "action_statement": "Vulnerability CVE-2026-113721 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T13:21:12.766719+00:00", "status_notes": "Vulnerability CVE-2026-113722 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-113722" }, "action_statement": "Vulnerability CVE-2026-113722 affects version 20.39.1.post4+tuxcare of virtualenv, and is fixed in 20.39.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113723 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113723" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:42:44.741580+00:00", "status_notes": "Vulnerability CVE-2026-113724 does not affect version 20.39.1.post4+tuxcare of virtualenv. CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-113724" }, "impact_statement": "CVE-2026-113724 (upstream fix 2bfdc023, #3427: safe_delete's rmtree onerror handler chmods files) does not apply to 20.39.1: here safe_delete calls rmtree(..., ignore_errors=True, onerror/onexc=...), and with ignore_errors=True CPython replaces the handler with a no-op, so the chmod path never runs; the working handler only appeared in 21.7.5 (#3222). Verified 27.10 with PoC on py3.9 and py3.12 (plain and --clear): key file permissions stay 0400." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:15:15.426797+00:00", "status_notes": "Vulnerability CVE-2026-113725 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-113726 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113726" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-113732 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113732" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T07:14:19.149939+00:00", "status_notes": "Vulnerability CVE-2026-113776 is fixed in version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-113776" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/virtualenv@20.39.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2026-115586 affects version 20.39.1.post4+tuxcare of virtualenv.", "vulnerability": { "name": "CVE-2026-115586" }, "action_statement": "Vulnerability CVE-2026-115586 affects version 20.39.1.post4+tuxcare of virtualenv." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37891" }, "action_statement": "Vulnerability CVE-2024-37891 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post4+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post4+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post9+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post9+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post9+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post9+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post9+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/scikit-learn@1.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/scikit-learn@1.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T23:49:59.024011+00:00", "status_notes": "Vulnerability CVE-2020-28975 affects version 1.0.2.post1+tuxcare of scikit-learn.", "vulnerability": { "name": "CVE-2020-28975" }, "action_statement": "Vulnerability CVE-2020-28975 affects version 1.0.2.post1+tuxcare of scikit-learn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/scikit-learn@1.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/scikit-learn@1.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-5206 affects version 1.0.2.post1+tuxcare of scikit-learn, and is fixed in 1.0.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-5206" }, "action_statement": "Vulnerability CVE-2024-5206 affects version 1.0.2.post1+tuxcare of scikit-learn, and is fixed in 1.0.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-29159 affects version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" }, "action_statement": "Vulnerability CVE-2023-29159 affects version 0.27.0.post8+tuxcare of starlette." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.27.0.post8+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.27.0.post8+tuxcare of starlette. Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "Version 0.27.0 is not vulnerable. Summary: The target repository (Starlette version 0.27.0) is NOT vulnerable to CVE-2025-62727. The vulnerable Range header parsing logic was introduced in version 0.39.0, and the target version 0.27.0 predates this introduction. The FileResponse class in version 0.27.0 does not implement any Range header parsing or processing functionality. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.27.0.post8+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.27.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.27.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.27.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post5+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post5+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyyaml@5.3.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyyaml@5.3.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2017-18342 affects version 5.3.1.post1+tuxcare of pyyaml.", "vulnerability": { "name": "CVE-2017-18342" }, "action_statement": "Vulnerability CVE-2017-18342 affects version 5.3.1.post1+tuxcare of pyyaml." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyyaml@5.3.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyyaml@5.3.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2020-14343 is fixed in version 5.3.1.post1+tuxcare of pyyaml.", "vulnerability": { "name": "CVE-2020-14343" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-37276 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-37276" }, "action_statement": "Vulnerability CVE-2023-37276 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-47627 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" }, "action_statement": "Vulnerability CVE-2023-47627 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:39:00.063841+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2025-69230 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69230" }, "action_statement": "Vulnerability CVE-2025-69230 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:16:00.136692+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.10.11.post1+tuxcare of aiohttp, and is fixed in 3.10.11.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.10.11.post1+tuxcare of aiohttp, and is fixed in 3.10.11.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.10.11.post1+tuxcare of aiohttp, and is fixed in 3.10.11.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.10.11.post1+tuxcare of aiohttp, and is fixed in 3.10.11.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111749 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111749" }, "action_statement": "Vulnerability CVE-2026-111749 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54275 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54275" }, "action_statement": "Vulnerability CVE-2026-54275 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54276 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54276" }, "action_statement": "Vulnerability CVE-2026-54276 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-54280 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54280" }, "action_statement": "Vulnerability CVE-2026-54280 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:35:00.300690+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:39:00.063841+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.10.11.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.10.11.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.10.11.post1+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post9+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post9+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-29159 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-29159" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-30798 affects version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2023-30798" }, "action_statement": "Vulnerability CVE-2023-30798 affects version 0.25.0.post1+tuxcare of starlette." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47874 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2024-47874" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-54121 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2025-54121" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62727 does not affect version 0.25.0.post1+tuxcare of starlette. CVE-2025-62727 is a Range header parsing flaw in FileResponse. That parsing was introduced upstream in starlette 0.39.0; version 0.25.0 predates it. Verified on tuxcare-current/0.25.0: the string \"Range\" does not occur anywhere in the starlette package, and FileResponse implements no range handling. Same disposition and same reasoning as starlette 0.27.0 (VPV 81209), which is already not_affected with justification code_not_present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62727" }, "impact_statement": "CVE-2025-62727 is a Range header parsing flaw in FileResponse. That parsing was introduced upstream in starlette 0.39.0; version 0.25.0 predates it. Verified on tuxcare-current/0.25.0: the string \"Range\" does not occur anywhere in the starlette package, and FileResponse implements no range handling. Same disposition and same reasoning as starlette 0.27.0 (VPV 81209), which is already not_affected with justification code_not_present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48710 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48710" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48817 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48818 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-48818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54282 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54282" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54283 is fixed in version 0.25.0.post1+tuxcare of starlette.", "vulnerability": { "name": "CVE-2026-54283" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-93gm-qmq6-w238 is a false positive for starlette 0.25.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-93gm-qmq6-w238" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/starlette@0.25.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/starlette@0.25.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qj8w-rv5x-2v9h is a false positive for starlette 0.25.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-qj8w-rv5x-2v9h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2019-1010083" }, "action_statement": "Vulnerability CVE-2019-1010083 affects version 1.1.4.post3+tuxcare of flask." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-30861 is fixed in version 1.1.4.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2023-30861" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask@1.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask@1.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27205 is fixed in version 1.1.4.post3+tuxcare of flask.", "vulnerability": { "name": "CVE-2026-27205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10216 is fixed in version 22.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "AIKIDO-2024-10216" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-1135 affects version 22.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-1135" }, "action_statement": "Vulnerability CVE-2024-1135 affects version 22.0.0.post1+tuxcare of gunicorn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/gunicorn@22.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6827 is fixed in version 22.0.0.post1+tuxcare of gunicorn.", "vulnerability": { "name": "CVE-2024-6827" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post8+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post8+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post8+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post8+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.25.11.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 1.25.11.post5+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.25.11.post5+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.25.11.post5+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.25.11.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.25.11.post5+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.25.11.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.25.11.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.25.11.post5+tuxcare of urllib3, and is fixed in 1.25.11.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45115 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45116 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-45452 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45452" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22818 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-22818" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-23833 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28346 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-28347 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-34265 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-36359 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23969 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-24580 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-25T12:33:00.867807+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post21+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post21+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post23+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.0.post15+tuxcare of django. not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.0 is not affected by CVE-2026-53878. The vulnerable component DomainNameValidator does not exist in this version (it was introduced in Django 5.1). All domain validation in Django 4.0 is performed by EmailValidator, URLValidator, and _simple_domain_name_validator, which properly reject domain names containing newline characters through various mechanisms (regex anchors, explicit unsafe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-30T05:57:00.104085+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.0.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.0.post15+tuxcare of django, and is fixed in 4.0.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-21T00:55:13.116458+00:00", "status_notes": "Vulnerability CVE-2026-114094 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114094" }, "action_statement": "Vulnerability CVE-2026-114094 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-21T00:55:13.116458+00:00", "status_notes": "Vulnerability CVE-2026-114095 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-114095" }, "action_statement": "Vulnerability CVE-2026-114095 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-05T09:08:00.103320+00:00", "status_notes": "Vulnerability CVE-2026-42305 is fixed in version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42305" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-42563 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-42563" }, "action_statement": "Vulnerability CVE-2026-42563 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-47712 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47712" }, "action_statement": "Vulnerability CVE-2026-47712 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-05T09:00:20.674619+00:00", "status_notes": "Vulnerability CVE-2026-47734 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-47734" }, "action_statement": "Vulnerability CVE-2026-47734 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:20:59.238378+00:00", "status_notes": "Vulnerability CVE-2026-52726 affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "CVE-2026-52726" }, "action_statement": "Vulnerability CVE-2026-52726 affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-05T09:00:20.674619+00:00", "status_notes": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post1+tuxcare of dulwich.", "vulnerability": { "name": "GHSA-35mr-4567-66vg" }, "action_statement": "Vulnerability GHSA-35mr-4567-66vg affects version 0.21.7.post1+tuxcare of dulwich." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-5fqc-mrg8-w798 does not affect version 0.21.7.post1+tuxcare of dulwich. GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5fqc-mrg8-w798" }, "impact_statement": "GHSA-5fqc-mrg8-w798 (filter-branch): dulwich/filter_branch.py does not exist in 0.21.7 (added upstream in 0.23.1). Reviewed in PYELSCVE-2844." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.21.7.post1+tuxcare of dulwich, and is fixed in 0.21.7.post2+tuxcare.", "vulnerability": { "name": "GHSA-8mcx-5rqc-vhmf" }, "action_statement": "Vulnerability GHSA-8mcx-5rqc-vhmf affects version 0.21.7.post1+tuxcare of dulwich, and is fixed in 0.21.7.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-8w8g-wq8h-fq33 does not affect version 0.21.7.post1+tuxcare of dulwich. GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8w8g-wq8h-fq33" }, "impact_statement": "GHSA-8w8g-wq8h-fq33 (checkout(paths=) via os.open): dulwich 0.21.7 porcelain has no checkout() function, no os.open() call and no _checked_worktree_path (checkout() appeared in 0.23.x, the os.open path in 0.24.0). Reviewed in PYELSCVE-2844." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/dulwich@0.21.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/dulwich@0.21.7.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-cm62-gvxx-vmxx does not affect version 0.21.7.post1+tuxcare of dulwich. GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cm62-gvxx-vmxx" }, "impact_statement": "GHSA-cm62-gvxx-vmxx (stash pop path traversal): in dulwich 0.21.7 Stash.pop() is `raise NotImplementedError(self.pop)` (dulwich/stash.py:70); pop was first implemented upstream in 0.24.0, so the vulnerable code is absent. Reviewed in PYELSCVE-2844." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2021-32677 affects version 0.104.1.post1+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2021-32677" }, "action_statement": "Vulnerability CVE-2021-32677 affects version 0.104.1.post1+tuxcare of fastapi." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24762 is fixed in version 0.104.1.post1+tuxcare of fastapi.", "vulnerability": { "name": "CVE-2024-24762" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/fastapi@0.104.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/fastapi@0.104.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-qf9m-vfgh-m389 is a false positive for fastapi 0.104.1.post1+tuxcare.", "vulnerability": { "name": "GHSA-qf9m-vfgh-m389" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post6+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post6+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post6+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post6+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-47287" }, "action_statement": "Vulnerability CVE-2025-47287 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-31958 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-31958" }, "action_statement": "Vulnerability CVE-2026-31958 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-35536 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-35536" }, "action_statement": "Vulnerability CVE-2026-35536 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49855 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49855" }, "action_statement": "Vulnerability CVE-2026-49855 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" }, "action_statement": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" }, "action_statement": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" }, "action_statement": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" }, "action_statement": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post1+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post4+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post4+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post4+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post4+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 5.1.1.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post3+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post3+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post3+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post3+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post3+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post9+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post9+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post9+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post9+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post9+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T05:09:00.313196+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post9+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post1+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post1+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-31958" }, "action_statement": "Vulnerability CVE-2026-31958 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-35536" }, "action_statement": "Vulnerability CVE-2026-35536 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-49855" }, "action_statement": "Vulnerability CVE-2026-49855 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" }, "action_statement": "Vulnerability GHSA-753j-mpmx-qq6g affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" }, "action_statement": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" }, "action_statement": "Vulnerability GHSA-qppv-j76h-2rpx affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" }, "action_statement": "Vulnerability GHSA-w235-7p84-xx57 affects version 6.1.0.post1+tuxcare of tornado, and is fixed in 6.1.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post7+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post7+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post7+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post7+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post7+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post5+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post5+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post5+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post5+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post10+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post10+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post10+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post10+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post2+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post2+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post2+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-49855" }, "action_statement": "Vulnerability CVE-2026-49855 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 6.1.0.post2+tuxcare of tornado, and is fixed in 6.1.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post2+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post8+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post8+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post8+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post8+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post8+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post5+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post5+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post5+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post5+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post5+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 5.1.1.post5+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post3+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post3+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post3+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post3+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-31958 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-31958" }, "action_statement": "Vulnerability CVE-2026-31958 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-35536 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-35536" }, "action_statement": "Vulnerability CVE-2026-35536 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49855 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49855" }, "action_statement": "Vulnerability CVE-2026-49855 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" }, "action_statement": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" }, "action_statement": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" }, "action_statement": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" }, "action_statement": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post3+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-67724 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67724" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-67725 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67725" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-67726 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-67726" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post6+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post6+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post6+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-82397 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-82397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 5.1.1.post6+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2023-28370" }, "action_statement": "Vulnerability CVE-2023-28370 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2025-47287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-25T03:25:31.426299+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 6.1.0.post4+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 6.1.0.post4+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 6.1.0.post4+tuxcare of tornado." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-31958 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-31958" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-35536 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-35536" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49853 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49853" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49854 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49854" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-49855 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-49855" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:10:00.146465+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T06:38:16.308362+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 6.1.0.post4+tuxcare of tornado, and is fixed in 6.1.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@6.1.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@6.1.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 is fixed in version 6.1.0.post4+tuxcare of tornado.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-28370 is fixed in version 5.1.1.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2023-28370" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52804 is fixed in version 5.1.1.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2024-52804" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47287 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-47287" }, "action_statement": "Vulnerability CVE-2025-47287 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67724 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67724" }, "action_statement": "Vulnerability CVE-2025-67724 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67725 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67725" }, "action_statement": "Vulnerability CVE-2025-67725 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2025-67726 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-67726" }, "action_statement": "Vulnerability CVE-2025-67726 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-115927 affects version 5.1.1.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-115927" }, "action_statement": "Vulnerability CVE-2026-115927 affects version 5.1.1.post2+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116577 affects version 5.1.1.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116577" }, "action_statement": "Vulnerability CVE-2026-116577 affects version 5.1.1.post2+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T04:17:38.235616+00:00", "status_notes": "Vulnerability CVE-2026-116578 affects version 5.1.1.post2+tuxcare of tornado.", "vulnerability": { "name": "CVE-2026-116578" }, "action_statement": "Vulnerability CVE-2026-116578 affects version 5.1.1.post2+tuxcare of tornado." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-31958 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-31958" }, "action_statement": "Vulnerability CVE-2026-31958 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-35536 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-35536" }, "action_statement": "Vulnerability CVE-2026-35536 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49853 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49853" }, "action_statement": "Vulnerability CVE-2026-49853 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49854 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49854" }, "action_statement": "Vulnerability CVE-2026-49854 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability CVE-2026-49855 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-49855" }, "action_statement": "Vulnerability CVE-2026-49855 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability CVE-2026-82397 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-82397" }, "action_statement": "Vulnerability CVE-2026-82397 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-3hv7-mjh2-fv65" }, "action_statement": "Vulnerability GHSA-3hv7-mjh2-fv65 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-753j-mpmx-qq6g" }, "action_statement": "Vulnerability GHSA-753j-mpmx-qq6g affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-78cv-mqj4-43f7" }, "action_statement": "Vulnerability GHSA-78cv-mqj4-43f7 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:50:05.718035+00:00", "status_notes": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-8423-8fgw-73vq" }, "action_statement": "Vulnerability GHSA-8423-8fgw-73vq affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T06:33:27.266844+00:00", "status_notes": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare.", "vulnerability": { "name": "GHSA-c2m8-h5v5-343r" }, "action_statement": "Vulnerability GHSA-c2m8-h5v5-343r affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare.", "vulnerability": { "name": "GHSA-chx6-46f5-w4vp" }, "action_statement": "Vulnerability GHSA-chx6-46f5-w4vp affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-pw6j-qg29-8w7f" }, "action_statement": "Vulnerability GHSA-pw6j-qg29-8w7f affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-qppv-j76h-2rpx" }, "action_statement": "Vulnerability GHSA-qppv-j76h-2rpx affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/tornado@5.1.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/tornado@5.1.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:44:50.265994+00:00", "status_notes": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-w235-7p84-xx57" }, "action_statement": "Vulnerability GHSA-w235-7p84-xx57 affects version 5.1.1.post2+tuxcare of tornado, and is fixed in 5.1.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:07:55.794391+00:00", "status_notes": "Vulnerability CVE-2024-10940 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-10940" }, "action_statement": "Vulnerability CVE-2024-10940 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:07:55.794391+00:00", "status_notes": "Vulnerability CVE-2024-1455 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-1455" }, "action_statement": "Vulnerability CVE-2024-1455 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2024-28088 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-28088" }, "action_statement": "Vulnerability CVE-2024-28088 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-65106 does not affect version 0.3.83.post2+tuxcare of langchain-core. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-65106" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2025-68664 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2025-68664" }, "action_statement": "Vulnerability CVE-2025-68664 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26013 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-26013" }, "action_statement": "Vulnerability CVE-2026-26013 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34070 is fixed in version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-34070" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:06:49.086571+00:00", "status_notes": "Vulnerability CVE-2026-40087 affects version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-40087" }, "action_statement": "Vulnerability CVE-2026-40087 affects version 0.3.83.post2+tuxcare of langchain-core." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44843 is fixed in version 0.3.83.post2+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-44843" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:05:56.841018+00:00", "status_notes": "Vulnerability CVE-2022-45907 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2022-45907" }, "action_statement": "Vulnerability CVE-2022-45907 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-31580 is fixed in version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2024-31580" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-31583 is fixed in version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2024-31583" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-7804 is a false positive for torch 1.13.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-7804" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2148 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2148" }, "action_statement": "Vulnerability CVE-2025-2148 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2149 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2149" }, "action_statement": "Vulnerability CVE-2025-2149 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2953 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2953" }, "action_statement": "Vulnerability CVE-2025-2953 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2998 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2998" }, "action_statement": "Vulnerability CVE-2025-2998 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2999 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2999" }, "action_statement": "Vulnerability CVE-2025-2999 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3000 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3000" }, "action_statement": "Vulnerability CVE-2025-3000 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3001 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3001" }, "action_statement": "Vulnerability CVE-2025-3001 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-32434 is fixed in version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-32434" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3730 affects version 1.13.1.post2+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3730" }, "action_statement": "Vulnerability CVE-2025-3730 affects version 1.13.1.post2+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:05:56.841018+00:00", "status_notes": "Vulnerability CVE-2022-45907 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2022-45907" }, "action_statement": "Vulnerability CVE-2022-45907 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-31580 affects version 1.13.1.post1+tuxcare of torch, and is fixed in 1.13.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-31580" }, "action_statement": "Vulnerability CVE-2024-31580 affects version 1.13.1.post1+tuxcare of torch, and is fixed in 1.13.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-31583 affects version 1.13.1.post1+tuxcare of torch, and is fixed in 1.13.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-31583" }, "action_statement": "Vulnerability CVE-2024-31583 affects version 1.13.1.post1+tuxcare of torch, and is fixed in 1.13.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-7804 is a false positive for torch 1.13.1.post1+tuxcare.", "vulnerability": { "name": "CVE-2024-7804" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2148 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2148" }, "action_statement": "Vulnerability CVE-2025-2148 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2149 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2149" }, "action_statement": "Vulnerability CVE-2025-2149 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2953 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2953" }, "action_statement": "Vulnerability CVE-2025-2953 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2998 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2998" }, "action_statement": "Vulnerability CVE-2025-2998 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-2999 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-2999" }, "action_statement": "Vulnerability CVE-2025-2999 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3000 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3000" }, "action_statement": "Vulnerability CVE-2025-3000 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3001 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3001" }, "action_statement": "Vulnerability CVE-2025-3001 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-32434 is fixed in version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-32434" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/torch@1.13.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/torch@1.13.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-3730 affects version 1.13.1.post1+tuxcare of torch.", "vulnerability": { "name": "CVE-2025-3730" }, "action_statement": "Vulnerability CVE-2025-3730 affects version 1.13.1.post1+tuxcare of torch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:07:55.794391+00:00", "status_notes": "Vulnerability CVE-2024-10940 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-10940" }, "action_statement": "Vulnerability CVE-2024-10940 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:07:55.794391+00:00", "status_notes": "Vulnerability CVE-2024-1455 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-1455" }, "action_statement": "Vulnerability CVE-2024-1455 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2024-28088 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2024-28088" }, "action_statement": "Vulnerability CVE-2024-28088 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-65106 does not affect version 0.3.83.post1+tuxcare of langchain-core. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-65106" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2025-68664 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2025-68664" }, "action_statement": "Vulnerability CVE-2025-68664 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26013 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-26013" }, "action_statement": "Vulnerability CVE-2026-26013 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34070 is fixed in version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-34070" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:06:49.086571+00:00", "status_notes": "Vulnerability CVE-2026-40087 affects version 0.3.83.post1+tuxcare of langchain-core.", "vulnerability": { "name": "CVE-2026-40087" }, "action_statement": "Vulnerability CVE-2026-40087 affects version 0.3.83.post1+tuxcare of langchain-core." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/langchain-core@0.3.83.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44843 affects version 0.3.83.post1+tuxcare of langchain-core, and is fixed in 0.3.83.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-44843" }, "action_statement": "Vulnerability CVE-2026-44843 affects version 0.3.83.post1+tuxcare of langchain-core, and is fixed in 0.3.83.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for protobuf 4.24.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2022-1941 affects version 4.24.3.post2+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2022-1941" }, "action_statement": "Vulnerability CVE-2022-1941 affects version 4.24.3.post2+tuxcare of protobuf." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-4565 is fixed in version 4.24.3.post2+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2025-4565" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0994 is fixed in version 4.24.3.post2+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2026-0994" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for protobuf 4.25.8.post1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2022-1941 affects version 4.25.8.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2022-1941" }, "action_statement": "Vulnerability CVE-2022-1941 affects version 4.25.8.post1+tuxcare of protobuf." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2025-4565 affects version 4.25.8.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2025-4565" }, "action_statement": "Vulnerability CVE-2025-4565 affects version 4.25.8.post1+tuxcare of protobuf." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@4.25.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.8.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-0994 is fixed in version 4.25.8.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2026-0994" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@3.17.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@3.17.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for protobuf 3.17.0.post1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@3.17.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@3.17.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-1941 is fixed in version 3.17.0.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2022-1941" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@3.17.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@3.17.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-4565 affects version 3.17.0.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2025-4565" }, "action_statement": "Vulnerability CVE-2025-4565 affects version 3.17.0.post1+tuxcare of protobuf." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@3.17.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@3.17.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0994 does not affect version 3.17.0.post1+tuxcare of protobuf. protobuf 3.17.0 has no recursion-depth limit to bypass. CVE-2026-0994 is a bypass of json_format's max_recursion_depth: _ConvertAnyMessage dispatched well-known types through methodcaller, skipping ConvertMessage and therefore the depth counter. On 3.17.0 there is no counter and no limit - the strings recursion_depth and max_recursion_depth do not occur anywhere in python/google/protobuf/json_format.py, ConvertMessage is declared (self, value, message) with no path argument, and the entry points expose no such parameter (3.17.0: ParseDict(js_dict, message, ignore_unknown_fields=False, descriptor_pool=None); 4.24.3: the same plus max_recursion_depth=100). Upstream's regression tests for this CVE call ParseDict(..., max_recursion_depth=5) and would raise TypeError here rather than exercise the fix. The guarded feature was introduced by a later upstream change, so the code this CVE concerns is not present. Stated separately so it is not lost: having no limit at all leaves 3.17.0 exposed to the unbounded-recursion issue that the limit was introduced to fix - a different vulnerability, not covered by this assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0994" }, "impact_statement": "protobuf 3.17.0 has no recursion-depth limit to bypass. CVE-2026-0994 is a bypass of json_format's max_recursion_depth: _ConvertAnyMessage dispatched well-known types through methodcaller, skipping ConvertMessage and therefore the depth counter. On 3.17.0 there is no counter and no limit - the strings recursion_depth and max_recursion_depth do not occur anywhere in python/google/protobuf/json_format.py, ConvertMessage is declared (self, value, message) with no path argument, and the entry points expose no such parameter (3.17.0: ParseDict(js_dict, message, ignore_unknown_fields=False, descriptor_pool=None); 4.24.3: the same plus max_recursion_depth=100). Upstream's regression tests for this CVE call ParseDict(..., max_recursion_depth=5) and would raise TypeError here rather than exercise the fix. The guarded feature was introduced by a later upstream change, so the code this CVE concerns is not present. Stated separately so it is not lost: having no limit at all leaves 3.17.0 exposed to the unbounded-recursion issue that the limit was introduced to fix - a different vulnerability, not covered by this assessment." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for protobuf 4.24.3.post1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2022-1941 affects version 4.24.3.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2022-1941" }, "action_statement": "Vulnerability CVE-2022-1941 affects version 4.24.3.post1+tuxcare of protobuf." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-4565 is fixed in version 4.24.3.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2025-4565" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.24.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.24.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0994 affects version 4.24.3.post1+tuxcare of protobuf, and is fixed in 4.24.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-0994" }, "action_statement": "Vulnerability CVE-2026-0994 affects version 4.24.3.post1+tuxcare of protobuf, and is fixed in 4.24.3.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-22570 is a false positive for protobuf 4.25.9.post1+tuxcare.", "vulnerability": { "name": "CVE-2021-22570" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2022-1941 affects version 4.25.9.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2022-1941" }, "action_statement": "Vulnerability CVE-2022-1941 affects version 4.25.9.post1+tuxcare of protobuf." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/protobuf@4.25.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2025-4565 affects version 4.25.9.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2025-4565" }, "action_statement": "Vulnerability CVE-2025-4565 affects version 4.25.9.post1+tuxcare of protobuf." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/protobuf@4.25.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/protobuf@4.25.9.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:28:00.133495+00:00", "status_notes": "Vulnerability CVE-2026-0994 is fixed in version 4.25.9.post1+tuxcare of protobuf.", "vulnerability": { "name": "CVE-2026-0994" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post19+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post19+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post19+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post19+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post19+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post19+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post19+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-103001" }, "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.3.0.post2+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:50:00.228674+00:00", "status_notes": "Vulnerability CVE-2026-48522 is fixed in version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48522" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:55:15.270861+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post2+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post2+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.3.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:26:12.093924+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 44.0.3.post2+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:09:39.325728+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 44.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "action_statement": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post7+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post7+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post7+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post7+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post7+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post7+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post7+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post7+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:26:05.784106+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-0727 is fixed in version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-07T15:46:00.061128+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "action_statement": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:10:00.833243+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:30:42.638167+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 41.0.7.post3+tuxcare of cryptography. not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post8+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post8+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post8+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post8+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post8+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post8+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post8+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post8+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post3+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post3+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post3+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post3+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post3+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post3+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post12+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post12+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post12+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post12+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post12+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post12+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post12+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:25:32.301563+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 45.0.7.post3+tuxcare of cryptography. Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 45.0.7.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39892 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 45.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 45.0.7.post3+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:03:20.676969+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:10:03.705151+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:32:48.378278+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 45.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.1.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.1.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post3+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post3+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:02:50.581840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:33:51.306192+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.1.post3+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 45.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 45.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:25:32.301563+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 45.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 45.0.7.post2+tuxcare of cryptography. Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 45.0.7.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39892 is fixed in version 45.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 45.0.7.post2+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:03:20.676969+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:10:03.705151+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:32:48.378278+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 45.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 is fixed in version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-3446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49083" }, "action_statement": "Vulnerability CVE-2023-49083 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 3.4.8.post3+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post3+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post3+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post3+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post3+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post12+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post12+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post12+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post12+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post12+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post12+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post12+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post12+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post12+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post12+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post12+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post17+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post17+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post17+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post17+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post17+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post17+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post17+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post17+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post9+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post9+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post9+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post9+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post9+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post9+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post9+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post9+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post7+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post2+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post15+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post15+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post15+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post15+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post15+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post15+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post15+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post15+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-3446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post6+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-49083" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post6+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post6+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post6+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post6+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post6+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post6+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post6+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post6+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post5+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post5+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post5+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post5+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post5+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post5+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post5+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post5+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post6+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.1.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 43.0.1.post4+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:02:50.581840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:33:51.306192+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.1.post4+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post18+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post18+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post18+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post18+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post18+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post18+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-21T08:23:00.096702+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post18+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post18+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post18+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:26:05.784106+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:46:00.061128+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post2+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post2+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "action_statement": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:10:00.833243+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:30:42.638167+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 41.0.7.post2+tuxcare of cryptography. not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.1.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.1.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post1+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:02:50.581840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:33:51.306192+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.1.post1+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:27:17.924054+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" }, "action_statement": "Vulnerability CVE-2024-0727 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-28T09:32:48.362925+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.0.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.0.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:49:00.173240+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 42.0.0.post1+tuxcare of cryptography, and is fixed in 42.0.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:42:00.095938+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:29:44.042761+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.0.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pydantic@1.10.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pydantic@1.10.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T15:51:14.981630+00:00", "status_notes": "Vulnerability CVE-2021-29510 affects version 1.10.0.post1+tuxcare of pydantic.", "vulnerability": { "name": "CVE-2021-29510" }, "action_statement": "Vulnerability CVE-2021-29510 affects version 1.10.0.post1+tuxcare of pydantic." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pydantic@1.10.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pydantic@1.10.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3772 is fixed in version 1.10.0.post1+tuxcare of pydantic.", "vulnerability": { "name": "CVE-2024-3772" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post5+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 43.0.3.post5+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post5+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post4+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post4+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post4+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post4+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post4+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post4+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post4+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post5+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post5+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post5+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post5+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post5+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post5+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post5+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post5+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post13+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post13+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post13+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post13+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post13+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post13+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post13+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post10+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target cryptography 41.0.7.post3+tuxcare is not affected by CVE-2023-23931. The upstream fix (commit 9fbf84efc by Alex Gaynor) that prevents mutation of immutable buffers was already included in the upstream release 41.0.7 before TuxCare's maintenance began. The vulnerable pattern (accepting immutable buffers without writability validation) is not present in HEAD. The code implements two de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:26:05.784106+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: The target repository (cryptography 41.0.7.post3+tuxcare) is NOT AFFECTED. The vulnerability - a NULL pointer dereference when loading PKCS#7 certificates with no certificates - was fixed in upstream release 41.0.6 (commit f09c261ca1) by Alex Gaynor on 2023-11-27. The fix adds a NULL check on p7.d.sign before dereferencing it to access p7.d.sign.cert, preventing the segfault. Si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-0727" }, "action_statement": "Vulnerability CVE-2024-0727 affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:46:00.061128+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 41.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The vulnerability exists in the `cryptography-x509-verification` Rust module, which performs X.509 certificate chain verification with DNS name constraint validation. This module does not exist in version 41.0.7 \u2014 it was introduced between versions 41.0.7 and 42.0.0. Version 41.0.7 only provides certificate..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 python-cryptography version 41.0.7.post2+tuxcare is NOT AFFECTED by CVE-2026-69248. The vulnerability exists in the x509 verification module's DNS name constraint matching logic when validating wildcard SANs against intermediate CA constraints. However, the entire x509.verification module (including PolicyBuilder, Store, build_server_verifier, and the Rust cryptography-x509-verification compone..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 41.0.7 is not affected by CVE-2026-69249. The vulnerable x509.verification module with its build_chain_inner function was introduced in cryptography version 42.0.0. Version 41.0.7 predates this feature and has no certificate chain validation API exposed to users. The INPUT type (certificate chains passed to PolicyBuilder.verify()) cannot be received in this version because the entire ve..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 41.0.7.post1+tuxcare of cryptography, and is fixed in 41.0.7.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 41.0.7 source distribution) is NOT AFFECTED by CVE-2023-2650. The vulnerability exists in OpenSSL's OBJ_obj2txt() function, which is NOT present in this repository. Cryptography uses its own Rust-based ASN.1/OID parser and does not declare or call the vulnerable OpenSSL function in its CFFI bindings. This is a source distribution containing only interfac..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "action_statement": "Vulnerability GHSA-h4gh-qq45-vh27 affects version 41.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:10:00.833243+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 41.0.7.post3+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerabilities in OpenSSL versions bundled within pre-built wheel binaries of cryptography \u226441.0.2. The target repository does not contain OpenSSL source code (0 C files, no vendored directories). The upstream fix (version 41.0.3, commits bfa4d95f0 and b22271cf3) updated build co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@41.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@41.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:30:42.638167+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 41.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 41.0.7.post3+tuxcare is not affected by GHSA-v8gr-m533-ghj9. The CVE affects cryptography 2.5-41.0.3 due to vulnerable OpenSSL versions bundled in wheels. The upstream fix (version 41.0.4, commit fc11bce69) updated bundled OpenSSL from 3.1.2 to 3.1.3, addressing the vulnerability. This fix was already present in the upstream release when TuxCare onboarded version 41.0.7. The targ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102275" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-103001" }, "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:50:00.228674+00:00", "status_notes": "Vulnerability CVE-2026-48522 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48522" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:55:15.270861+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post4+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.3.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-103001" }, "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:50:00.228674+00:00", "status_notes": "Vulnerability CVE-2026-48522 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48522" }, "action_statement": "Vulnerability CVE-2026-48522 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:55:15.270861+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post1+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.3.0.post1+tuxcare of pyjwt, and is fixed in 2.3.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 45.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 45.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 45.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 45.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:25:32.301563+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 45.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 45.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 45.0.7.post1+tuxcare of cryptography. Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 45.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 45.0.7.post1+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 45.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 45.0.7.post1+tuxcare of cryptography, and is fixed in 45.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:03:20.676969+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:10:03.705151+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:32:48.378278+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 45.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-3446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post5+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-49083" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 3.4.8.post5+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 3.4.8.post5+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post5+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post5+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post5+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post5+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post5+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post5+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post5+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2022-21712 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-21712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2022-24801 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-24801" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2022-39348 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-39348" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2023-46137 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2023-46137" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2024-41671 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41671" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2024-41810 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41810" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-106454 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-106454" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115774 affects version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115774" }, "action_statement": "Vulnerability CVE-2026-115774 affects version 20.3.0.post7+tuxcare of twisted." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115775 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115775" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115776 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115776" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115778 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115778" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115877 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-42304 is fixed in version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-42304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T14:53:31.015773+00:00", "status_notes": "Vulnerability CVE-2026-83813 affects version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-83813" }, "action_statement": "Vulnerability CVE-2026-83813 affects version 20.3.0.post7+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post7+tuxcare of twisted.", "vulnerability": { "name": "GHSA-vpp8-g58w-m8mp" }, "action_statement": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post7+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:26:12.093924+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:09:39.325728+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 44.0.3.post4+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "action_statement": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post23+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post23+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post23+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post23+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post23+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post23+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post23+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post23+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post23+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post23+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post23+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post23+tuxcare" } } ], "timestamp": "2026-10-29T12:14:40.101161+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post23+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 3.4.8.post4+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 3.4.8.post4+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 is fixed in version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-3446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 is fixed in version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-49083" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 3.4.8.post4+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 3.4.8.post4+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post4+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post4+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post4+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 45.0.7.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 45.0.7. The vulnerable Python CFFI backend (src/cryptography/hazmat/backends/openssl/ciphers.py) that allowed immutable buffers in update_into() has been completely replaced with a Rust implementation that enforces buffer writability. The fix was introduced by upstream commit 50ea0faab70 (Feb 2024, author: alex.gaynor@gmail.com) which migrated symme..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 45.0.7.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:25:32.301563+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083: Target version 45.0.7 is not affected. The vulnerability existed in Python code that directly accessed OpenSSL C structures via FFI without NULL-pointer validation. Version 45.0.7 uses a Rust implementation (migrated upstream in Jan 2024, commit 41daf2d86) that handles PKCS7 parsing through safe abstractions (Option types). When the malicious input (PKCS7 with NULL signed data p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 45.0.7.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target version (cryptography 45.0.7.post4+tuxcare) bundles OpenSSL 3.5.2 in its wheel distributions, which already contains the fix for CVE-2024-0727. The vulnerability is in OpenSSL's PKCS12 parsing functions (PKCS12_parse, etc.) where NULL pointer checks were missing. OpenSSL versions 3.2.1, 3.1.5, and 3.0.13 (released January 2024) fixed this issue. The target's bundled OpenSSL 3.5.2 (re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 45.0.7.post4+tuxcare of cryptography. Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "Not affected: CVE-2024-12797 affects OpenSSL 3.2.0-3.2.3, 3.3.0-3.3.2 and 3.4.0 (RFC7250 Raw Public Keys). All published cryptography 45.0.7 wheels (post1-post4) were checked in Nexus: manylinux2014 wheels bundle OpenSSL 3.3.3, which contains the fix; manylinux_2_28 wheels bundle OpenSSL 1.1.1k, which has no RPK support. The earlier withdrawn state was set by mistake during onboarding; the CVE itself is valid (PATCHFLOW-1284)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 45.0.7.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-39892 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 45.0.7.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The source repository does not contain OpenSSL source code. The vulnerability (GHSA-537c-gmf6-5ccf) affects OpenSSL bundled in binary wheels distributed on PyPI, not the cryptography source code itself. OpenSSL is downloaded and compiled during the wheel build process via build_openssl.sh, not present in the repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability affecting cryptography's binary wheels that bundle vulnerable OpenSSL versions. The CVE explicitly states that cryptography versions 0.5-40.0.2 are vulnerable. The target version is 45.0.7.post4+tuxcare, which is well beyond the vulnerable range. Upstream cryptography 41.0.0 (released 2023-05-30) was the first version to bundle patched OpenSSL 3.1.1, an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:03:20.676969+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 45.0.7.post4+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). This CVE concerns a vulnerability in OpenSSL's X.509 certificate name checking implementation, not in the cryptography library's code. The cryptography source repository contains only bindings to OpenSSL (CFFI declarations in Python and Rust FFI wrappers) but not the OpenSSL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:10:03.705151+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 45.0.7 was never affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 0.8-41.0.2. The vulnerability was fixed in version 41.0.3 (August 2023) by upgrading to OpenSSL 3.1.2. Version 45.0.7 was released in September 2025, approximately 2 years after the fix, and bundles OpenSSL 3.5.2 (inherited from version 45.0...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@45.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@45.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:32:48.378278+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 45.0.7.post4+tuxcare of cryptography. not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (45.0.7.post4+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The vulnerability was fixed in version 41.0.4 by upgrading to OpenSSL 3.1.3/3.0.11. The target version 45.0.7 is significantly newer (released ~2 years after the fix) and uses OpenSSL versions 3.5.0, 3.5.1, 3.4.1,..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post18+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post18+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post18+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post18+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post18+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post18+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post18+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post18+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post18+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post18+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post18+tuxcare" } } ], "timestamp": "2026-10-07T11:30:32.623961+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post18+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post8+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post3+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post3+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post3+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post3+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post3+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post3+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post3+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post3+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post3+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post3+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post11+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post22+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post22+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post22+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post22+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post22+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post22+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post22+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post22+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post22+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post22+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post22+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post22+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post22+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post22+tuxcare" } } ], "timestamp": "2026-10-23T07:22:40.428760+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post22+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21712 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-21712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24801 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-24801" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-39348 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-39348" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46137 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2023-46137" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41671 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41671" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41810 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41810" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-09T06:10:06.243250+00:00", "status_notes": "Vulnerability CVE-2026-106454 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-106454" }, "action_statement": "Vulnerability CVE-2026-106454 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T20:55:55.110460+00:00", "status_notes": "Vulnerability CVE-2026-115774 affects version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115774" }, "action_statement": "Vulnerability CVE-2026-115774 affects version 20.3.0.post5+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115775 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115775" }, "action_statement": "Vulnerability CVE-2026-115775 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115776 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115776" }, "action_statement": "Vulnerability CVE-2026-115776 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115778 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115778" }, "action_statement": "Vulnerability CVE-2026-115778 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115877 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115877" }, "action_statement": "Vulnerability CVE-2026-115877 affects version 20.3.0.post5+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42304 is fixed in version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-42304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T14:53:31.015773+00:00", "status_notes": "Vulnerability CVE-2026-83813 affects version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-83813" }, "action_statement": "Vulnerability CVE-2026-83813 affects version 20.3.0.post5+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post5+tuxcare of twisted.", "vulnerability": { "name": "GHSA-vpp8-g58w-m8mp" }, "action_statement": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post5+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 43.0.1.post4+tuxcare. The vulnerability was fixed in upstream version 39.0.1 (Feb 2023), well before version 43.0.1 was released. The target version includes the fix through its upstream lineage. Although the implementation migrated from Python/cffi to Rust between versions 39.x and 43.x, the defense is semantically equivalent: the Rust code enforce..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 is NOT present in cryptography 43.0.1. The NULL-pointer dereference vulnerability was fixed by upstream in commit 1e7b4d074 (Nov 27, 2023), which added a NULL check before accessing p7.d.sign.cert. The code was later migrated to Rust (commit 41daf2d86, Jan 22, 2024), where the fix is maintained via safe pattern matching (pkcs7.signed().and_then()). Both fixes are present in HEAD ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability affecting PKCS12 parsing functions (PKCS12_parse, PKCS12_unpack_p7data, etc.) that can lead to NULL pointer dereference and DoS. The cryptography library calls these OpenSSL APIs via Rust FFI (pkcs12.rs lines 702-724), but bundles OpenSSL 3.4.6 in its wheels, which has the vulnerability fixed. The upstream 43.0.1 release (September 2024) already shipped..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.1.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.1.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.1.post2+tuxcare of cryptography, and is fixed in 43.0.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:45:45.459074+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i...", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 CVE-2023-2650 is an OpenSSL vulnerability in OBJ_obj2txt() that affects OpenSSL versions prior to 3.0.9/3.1.1/1.1.1u. The cryptography source repository does not vendor OpenSSL code - it only declares OpenSSL as a dependency via Rust crates (openssl 0.10.66, openssl-sys 0.9.101). The vulnerable code is not present in this repository. While upstream cryptography 43.0.1 bundles OpenSSL 3.3.2 in i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:02:50.581840+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target source repository (cryptography 43.0.1.post4+tuxcare) is not affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This CVE affects OpenSSL versions 3.0-3.3 prior to their respective patch releases (3.3.2, 3.2.3, 3.1.7, 3.0.15). The vulnerability is in OpenSSL's X.509 certificate name checking code, which causes denial of service via invalid memory reads. The cryptography source repositor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target cryptography version 43.0.1.post4+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels versions 0.8-41.0.2. The fix was released in version 41.0.3 (2023-08-01) which updated wheels to use OpenSSL 3.1.2. The target version 43.0.1 (released 2024-09-03) is significantly newer and ships with OpenSSL 3.3.2 in its whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:33:51.306192+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.1.post2+tuxcare of cryptography. not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (cryptography 43.0.1.post4+tuxcare) is NOT affected by CVE-2023-4807. The vulnerability affects OpenSSL versions 3.1.0-3.1.2 (and other ranges) and was fixed in OpenSSL 3.1.3. The upstream cryptography 43.0.1 release (Sept 2024) shipped with OpenSSL 3.3.2, and the current target bundles OpenSSL 3.4.6 \u2014 both well beyond the fixed version. The vulnerable code pattern was never ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post5+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pydantic@v1.10.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pydantic@v1.10.5.post1+tuxcare" } } ], "timestamp": "2026-10-29T15:51:14.981630+00:00", "status_notes": "Vulnerability CVE-2021-29510 affects version v1.10.5.post1+tuxcare of pydantic.", "vulnerability": { "name": "CVE-2021-29510" }, "action_statement": "Vulnerability CVE-2021-29510 affects version v1.10.5.post1+tuxcare of pydantic." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pydantic@v1.10.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pydantic@v1.10.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3772 is fixed in version v1.10.5.post1+tuxcare of pydantic.", "vulnerability": { "name": "CVE-2024-3772" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post10+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post10+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post10+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post10+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post10+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post10+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post10+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-3446" }, "action_statement": "Vulnerability CVE-2023-3446 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49083" }, "action_statement": "Vulnerability CVE-2023-49083 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 3.4.8.post1+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post1+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post1+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post1+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post1+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post20+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post20+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post20+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post20+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post20+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post20+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post20+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post20+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post20+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post20+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post20+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post20+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post20+tuxcare" } } ], "timestamp": "2026-10-20T07:45:12.238158+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post20+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post19+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post19+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post19+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post19+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post19+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post19+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post19+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post19+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post19+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post19+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post19+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post16+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post16+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post16+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-09T07:01:00.106714+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post16+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post16+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post16+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post9+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post16+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post16+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post16+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post16+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post16+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post16+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post16+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post16+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post16+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post16+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post16+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post16+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post15+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post15+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post15+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post15+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post15+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-07T12:35:00.156725+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post15+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post15+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post15+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post15+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post14+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post14+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post14+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post14+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post14+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post14+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post4+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post4+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post4+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post4+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post4+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post4+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post4+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post4+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post4+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post4+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2022-21712 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-21712" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2022-24801 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-24801" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2022-39348 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-39348" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2023-46137 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2023-46137" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2024-41671 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41671" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2024-41810 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41810" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:10:06.243250+00:00", "status_notes": "Vulnerability CVE-2026-106454 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-106454" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T20:55:55.110460+00:00", "status_notes": "Vulnerability CVE-2026-115774 affects version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115774" }, "action_statement": "Vulnerability CVE-2026-115774 affects version 20.3.0.post6+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115775 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115775" }, "action_statement": "Vulnerability CVE-2026-115775 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115776 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115776" }, "action_statement": "Vulnerability CVE-2026-115776 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115778 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115778" }, "action_statement": "Vulnerability CVE-2026-115778 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115877 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115877" }, "action_statement": "Vulnerability CVE-2026-115877 affects version 20.3.0.post6+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-09T06:09:00.242384+00:00", "status_notes": "Vulnerability CVE-2026-42304 is fixed in version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-42304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T14:53:31.015773+00:00", "status_notes": "Vulnerability CVE-2026-83813 affects version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-83813" }, "action_statement": "Vulnerability CVE-2026-83813 affects version 20.3.0.post6+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post6+tuxcare of twisted.", "vulnerability": { "name": "GHSA-vpp8-g58w-m8mp" }, "action_statement": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post6+tuxcare of twisted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-49082" }, "action_statement": "Vulnerability CVE-2023-49082 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post1+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post1+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post1+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post1+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post1+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post6+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post6+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post6+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post6+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post6+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post6+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post6+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-23931 is fixed in version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-23931" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-3446 is fixed in version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-3446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 3.4.8.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49083 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49083" }, "action_statement": "Vulnerability CVE-2023-49083 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50782 is fixed in version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-08T14:32:14.883801+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 parsing functions). The target repository (pyca/cryptography 3.4.8) does NOT contain the vulnerable code - it only contains CFFI binding declarations and Python wrappers that call OpenSSL functions. The vulnerability exists in the OpenSSL dependency, not in cryptography's source code. The upstream patch (commit 351959..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-12797 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-12797" }, "action_statement": "Vulnerability CVE-2024-12797 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 3.4.8.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 3.4.8.post2+tuxcare of cryptography, and is fixed in 3.4.8.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 3.4.8.post2+tuxcare of cryptography. Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "Not affected. CVE-2026-34073 (GHSA-m959-cc7f-wv43) is a defect in cryptography's own X.509 path validator: DNS name constraints were validated only against SANs in child certificates and not against the peer name presented at validation time. The upstream fix (pyca/cryptography 91d728897bdad30cd5c79a2b23e207f1f050d587, cherry-pick of #14542) changes production code only in src/rust/cryptography-x509-verification/{lib.rs,types.rs}, plus tests/x509/verification/test_limbo.py. That crate -- and its predecessor name cryptography-x509-validation -- first ships in tag 42.0.0. cryptography 3.4.8 does not contain it: src/rust holds only an empty _rust pymodule stub, there is no cryptography.x509.verification module, and no PolicyBuilder/Store/ClientVerifier/ServerVerifier/VerificationError. Verified empirically on the installed package -- 3.4.8 and 41.0.7: import of cryptography.x509.verification raises ModuleNotFoundError and none of the verifier symbols exist; 42.0.8: the module is present -- and on our shipped tree at tag tuxcare-release/3.4.8/3.4.8.post5+tuxcare, which likewise has no verification crate. NameConstraints in 3.4.8 is ASN.1 parse/encode of the extension only (x509/extensions.py, _decode/_encode_name_constraints); there is no chain building and no peer-name matching, so the vulnerable code path does not exist. 3.4.8 is flagged only because OSV declares the affected range as introduced:0 / fixed:46.0.6, which lists all 151 versions from 0.1 onwards rather than scoping it to 42.0.0+. Assessed and closed Won't Fix in PYELSCVE-644 on 2026-04-08. This VPV had been parked in patch_application_parent_pending behind leader VPV 46321 (cryptography 45.0.7), which has since released as 45.0.7.post3+tuxcare, so the follower never unblocked." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 3.4.8.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 3.4.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 3.4.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Version 3.4.8 is not affected by CVE-2026-69248. The vulnerability exists in python-cryptography's x509.verification module, which was introduced in version 42.0.0 (September 2023). Version 3.4.8, released in August 2021, predates this module by over two years and contains no certificate chain verification functionality. The CVE describes a bug in DNS wildcard name constraint matching within th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69249" }, "impact_statement": "not_affected \u2014 Version 3.4.8 does not contain the cryptography.x509.verification module or the cryptography-x509-verification Rust crate where the vulnerable build_chain_inner function resides. Certificate chain validation functionality was introduced 11 major versions later in version 42.0.0 (released 2024). Version 3.4.8 provides certificate parsing and building capabilities only, not chain validation. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The CVE concerns vulnerable OpenSSL bundled in pre-built cryptography WHEELS (binary distributions), not the source code. The target repository (version 3.4.8.post5+tuxcare) contains only cryptography's source code and Python bindings to OpenSSL, but does NOT contain OpenSSL source code or binaries. The CVE explicitly states: 'If you are building cryptography source (sdist) then you are respons..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 3.4.8.post2+tuxcare of cryptography. cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "cryptography 3.4.8 has no Rust x509 stack (src/rust/src/lib.rs is an empty pymodule stub); certificate and OCSP parsing go through OpenSSL via CFFI. The upstream fix 93c96b777 changes cryptography-x509/src/common.rs, x509/ocsp.rs and x509/sign.rs, none of which exist on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:01:52.766308+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 3.4.8.post6+tuxcare is NOT affected by CVE-2024-6119 (GHSA-h4gh-qq45-vh27). This vulnerability affects OpenSSL 3.x versions bundled in cryptography 37.0.0-43.0.0. The target version uses OpenSSL 1.1.1.x (specifically 1.1.1l or 1.1.1k), which the OpenSSL advisory explicitly states is not vulnerable. Additionally, cryptography 3.4.8 predates OpenSSL 3 support entir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:39:00.190352+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 3.4.8.post6+tuxcare source code) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions statically linked into binary wheels distributed on PyPI, not the source code itself. The source repository contains only Python bindings to OpenSSL and does not bundle the OpenSSL library. The CVE explicitly states: \"If you are building cryp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@3.4.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@3.4.8.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:38:00.147645+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 3.4.8.post2+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography 3.4.8.post6+tuxcare) is NOT AFFECTED by GHSA-v8gr-m533-ghj9 / CVE-2023-4807. This vulnerability exists in OpenSSL's POLY1305 MAC implementation, which is NOT present in the cryptography source repository. OpenSSL is a build-time and runtime dependency that is downloaded separately. The CVE advisory explicitly states: \"If you are building cryptography sou..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post21+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post21+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post21+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post21+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post21+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post21+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post21+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post21+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post21+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post21+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post21+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post21+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post21+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post21+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post21+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post21+tuxcare" } } ], "timestamp": "2026-10-21T08:32:32.446741+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post21+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post6+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post6+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post6+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post6+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post6+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post6+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post6+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post6+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post6+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post6+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post14+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post14+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post14+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post14+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post14+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post14+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post14+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post14+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post14+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post14+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 is fixed in version 3.8.5.post14+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post1+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post1+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post1+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post1+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post1+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post1+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post1+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post1+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post1+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post1+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post2+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post2+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post1+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post8+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post8+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post8+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post8+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post8+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post8+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post8+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post8+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post8+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post8+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post8+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post11+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post11+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post11+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post11+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post11+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post11+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post11+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post11+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post9+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post9+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post9+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post9+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post9+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post9+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post9+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post9+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post9+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post10+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post10+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post10+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post10+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post10+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post10+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post10+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post10+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post10+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post10+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post10+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:27:17.924054+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" }, "action_statement": "Vulnerability CVE-2024-0727 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-28T09:32:48.362925+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 42.0.0.post2+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 42.0.0.post2+tuxcare of cryptography, and is fixed in 42.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.0.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:49:00.173240+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 42.0.0.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T15:42:00.095938+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:29:44.042761+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.0.post2+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post7+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post7+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post7+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post7+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post7+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post7+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post7+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post7+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post7+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post7+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post7+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post11+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post11+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post11+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post11+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post11+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post11+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post11+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post11+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post11+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 43.0.3.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post4+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post4+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post4+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post3+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post13+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post13+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post13+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post13+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post13+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post13+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post13+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post13+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post13+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 43.0.3.post3+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 43.0.3.post3+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post3+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post3+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post3+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post17+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post17+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post17+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post17+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post17+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post17+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post17+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post17+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-20T06:47:00.120609+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post17+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post17+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post17+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post17+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:02:59.777498+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.5.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 CVE-2023-37276 affects aiohttp v3.8.4 and earlier due to bundled llhttp v6.0.6 being vulnerable to CVE-2023-30589 (HTTP request smuggling via bare CR in headers). The target version 3.8.5.post23+tuxcare contains llhttp 9.1.3, which includes the upstream fix from v8.1.1. The vulnerable llhttp v6.0.6 code that incorrectly accepted bare CR characters in HTTP headers is not present. The fix was del..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-47627 is fixed in version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-47627" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-30251" }, "action_statement": "Vulnerability CVE-2024-30251 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-25T13:12:52.268351+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-08T10:58:59.844703+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.5.post2+tuxcare of aiohttp. aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.5 has no aiohttp/_cookie_helpers.py; BaseRequest.cookies uses stdlib SimpleCookie and performs no per-cookie logging, so the log-flooding path fixed by upstream 64629a08 does not exist on this branch." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T07:46:00.123593+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post20+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.5.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:22:59.176832+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post22+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-29T12:16:32.540816+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post23+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T21:14:00.079965+00:00", "status_notes": "Vulnerability CVE-2026-111749 is a false positive for aiohttp 3.8.5.post2+tuxcare. false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ...", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "false_positive \u2014 CVE-2026-111749 is a false positive - the advisory was matched to the wrong project. Despite aiohttp having cookie-handling functionality with Host-Only flag support, there is zero evidence linking this CVE to aiohttp: no commits reference CVE-2026-111749, no CHANGES.rst entries, and exhaustive grep searches across the repository returned no results. The CVE description is generic and does not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.5.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 does not affect version 3.8.5.post2+tuxcare of aiohttp. aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5.", "vulnerability": { "name": "CVE-2026-34515" }, "impact_statement": "aiohttp 3.8.5 already carries an equivalent guard that predates this CVE: StaticResource._handle does Path(rel_url) and raises HTTPForbidden when filename.anchor is set, before self._directory.joinpath() and therefore before any resolve(). Path.anchor and Path.is_absolute() agree on every relevant input (//remote/share, /absolute/path, D:\\path, relative names), so the control blocks exactly what the upstream fix 0ae2aa076c84 blocks; only the status differs (403 vs 404). The CVE applies to 3.8.6 because a backport had removed that check there - restored in MR !140. No code change is needed on 3.8.5." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:36:00.269369+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.5.post2+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 Version 3.8.5 does not support the per-request server_hostname parameter feature required to trigger this vulnerability. The server_hostname is always derived from req.host internally, which is already included in the ConnectionKey, preventing incorrect connection reuse." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.5.post2+tuxcare of aiohttp. not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 DigestAuthMiddleware component does not exist in aiohttp version 3.8.5. The vulnerable component was introduced 4623 commits later in May 2025. The target version only supports BasicAuth, which already includes cross-origin protection that strips Authorization headers on redirects to different origins." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.5.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:37:00.217692+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post18+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.5.post2+tuxcare of aiohttp. not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "not_affected \u2014 Version 3.8.5 is not affected by CVE-2026-54280. The vulnerability requires the Payload.close() architecture introduced in aiohttp 3.14+, where write_eof() must explicitly call close() in a try/finally block. Version 3.8.5 uses a fundamentally different pattern: file cleanup is embedded within payload write() methods via try/finally blocks, ensuring resources are released even when transmission..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.5.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.5.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare.", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "action_statement": "Vulnerability GHSA-pjjw-qhg8-p2p9 affects version 3.8.5.post2+tuxcare of aiohttp, and is fixed in 3.8.5.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow-skinny@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow-skinny@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post4+tuxcare of mlflow-skinny. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 The target (cryptography 42.0.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-23931. The vulnerability allowed Cipher.update_into() to accept and mutate immutable buffers by missing the require_writable=True parameter. The fix is already present at line 160 of src/cryptography/hazmat/backends/openssl/ciphers.py. This fix came from upstream commit 9fbf84efc (2023-02-07) authored by Alex Gaynor, whi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:27:17.924054+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 (NULL-pointer dereference in PKCS7 certificate loading) does not affect target version 42.0.0.post3+tuxcare. The vulnerable Python backend implementation was completely replaced by a Rust implementation (commit 41daf2d86, Jan 2024) that uses memory-safe Option handling instead of raw pointer access. The Rust code at src/rust/src/pkcs7.rs:315-321 uses `pkcs7.signed().and_then(|x| ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-0727 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-0727" }, "action_statement": "Vulnerability CVE-2024-0727 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-28T09:32:48.362925+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-26130 is fixed in version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.0.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-07T15:49:00.173240+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 CVE-2026-69248 affects python-cryptography versions with wildcard DNS SAN support in name constraint validation (introduced in commit 286c89128, Jan 2025). Version 42.0.0.post3 predates that feature and does not include the vulnerable wildcard handling logic. Wildcard SANs are rejected as malformed before reaching validation logic, preventing exploitation." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 42.0.0.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op...", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.0.post1+tuxcare source code) is not affected by GHSA-537c-gmf6-5ccf. This CVE concerns vulnerable OpenSSL bundled in pre-built PyPI wheels, not the cryptography source code itself. The CVE explicitly excludes source builds from its scope, stating that sdist users are responsible for their own OpenSSL. The target is a source repository with no vendored Op..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:39:32.016379+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version 42.0.0.post3+tuxcare is NOT vulnerable to GHSA-5cpq-8wj7-hf2v (CVE-2023-2650). This CVE affects cryptography wheels that bundle vulnerable OpenSSL versions with a quadratic time complexity issue in OBJ_obj2txt() when processing very large OBJECT IDENTIFIERs. The target bundles OpenSSL 3.2.0 (per CHANGELOG.rst), which is not vulnerable. The fix was shipped in upstream release ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-07T15:42:00.095938+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi...", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target repository (pyca/cryptography v42.0.0.post3+tuxcare) is NOT AFFECTED by GHSA-h4gh-qq45-vh27 (CVE-2024-6119). The vulnerability exists in OpenSSL's C implementation of X.509 certificate name checking (specifically, out-of-bounds memory access when processing malformed otherName subject alternative name fields). The cryptography repository contains NO OpenSSL source code - only CFFI bi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is not affected by GHSA-jm77-qphf-c4w8. This advisory concerns vulnerable OpenSSL versions bundled in binary wheels for cryptography 0.8-41.0.2. The target is based on upstream version 42.0.0 (released 2024-01-22), which ships wheels compiled with OpenSSL 3.2.0 \u2014 a patched version that does not contain CVE-2023-3446, CVE-2023-3817, or CVE-2023-2975. The fix w..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:29:44.042761+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.0.post3+tuxcare of cryptography. not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 42.0.0.post3+tuxcare is above the vulnerable range (2.5-41.0.3). The vulnerability concerns cryptography's binary wheels bundling vulnerable OpenSSL versions. Upstream 42.0.0 (released 2024-01-22) already updated to OpenSSL 3.2.0, which includes fixes for the September 2023 OpenSSL security advisory. This upstream fix was already present in the release that TuxCare based their 42..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.3.0.post3+tuxcare of pyjwt, and is fixed in 2.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-103001 affects version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-103001" }, "action_statement": "Vulnerability CVE-2026-103001 affects version 2.3.0.post3+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:50:00.228674+00:00", "status_notes": "Vulnerability CVE-2026-48522 is fixed in version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48522" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:55:15.270861+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.3.0.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.3.0.post4+tuxcare is NOT affected by CVE-2026-48523. The vulnerability requires the \"Decode with PyJWK\" feature (commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1), which was introduced in version 2.9.0 and is NOT present in this version. In 2.3.0, PyJWK objects cannot be passed directly to jwt.decode() as verification keys - the documented API requires extracting .key first. The attack c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 2.3.0.post3+tuxcare of pyjwt. not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 Target PyJWT version 2.3.0 is not affected by CVE-2026-48524. The vulnerability requires the jwk_set_cache feature with a finally-block cache-clearing pattern that was introduced in version 2.5.0. Version 2.3.0 predates this feature and uses a simpler lru_cache-based architecture that inherently avoids the cache-clearing behavior." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.3.0.post3+tuxcare of pyjwt. not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "not_affected \u2014 Version 2.3.0.post1+tuxcare does not support RFC 7797 detached payloads (b64=false feature), which is the attack vector for CVE-2026-48525. The vulnerability-specific code path does not exist in this version." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:09:00.152346+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.3.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49081 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare.", "vulnerability": { "name": "CVE-2023-49081" }, "action_statement": "Vulnerability CVE-2023-49081 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23334 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-23334" }, "action_statement": "Vulnerability CVE-2024-23334 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-23829 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-23829" }, "action_statement": "Vulnerability CVE-2024-23829 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27306 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-27306" }, "action_statement": "Vulnerability CVE-2024-27306 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2024-52304 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2024-52304" }, "action_statement": "Vulnerability CVE-2024-52304 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-53643 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-53643" }, "action_statement": "Vulnerability CVE-2025-53643 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-69223 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-69223" }, "action_statement": "Vulnerability CVE-2025-69223 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69224 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69224" }, "action_statement": "Vulnerability CVE-2025-69224 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69225 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-69225" }, "action_statement": "Vulnerability CVE-2025-69225 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69226 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69226" }, "action_statement": "Vulnerability CVE-2025-69226 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69227 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69227" }, "action_statement": "Vulnerability CVE-2025-69227 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69228 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69228" }, "action_statement": "Vulnerability CVE-2025-69228 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69229 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-69229" }, "action_statement": "Vulnerability CVE-2025-69229 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post2+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111063 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111063" }, "action_statement": "Vulnerability CVE-2026-111063 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T06:49:00.108290+00:00", "status_notes": "Vulnerability CVE-2026-111064 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-111064" }, "action_statement": "Vulnerability CVE-2026-111064 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:06:00.097249+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:23:26.046697+00:00", "status_notes": "Vulnerability CVE-2026-111066 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare.", "vulnerability": { "name": "CVE-2026-111066" }, "action_statement": "Vulnerability CVE-2026-111066 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post19+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare.", "vulnerability": { "name": "CVE-2026-111748" }, "action_statement": "Vulnerability CVE-2026-111748 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post20+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T21:12:21.485889+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:01:00.082132+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22815 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-22815" }, "action_statement": "Vulnerability CVE-2026-22815 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34513 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34513" }, "action_statement": "Vulnerability CVE-2026-34513 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34514 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34514" }, "action_statement": "Vulnerability CVE-2026-34514 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34515 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34515" }, "action_statement": "Vulnerability CVE-2026-34515 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34516 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34516" }, "action_statement": "Vulnerability CVE-2026-34516 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34517 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34517" }, "action_statement": "Vulnerability CVE-2026-34517 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34518 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-34518" }, "action_statement": "Vulnerability CVE-2026-34518 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34519 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34519" }, "action_statement": "Vulnerability CVE-2026-34519 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34520 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34520" }, "action_statement": "Vulnerability CVE-2026-34520 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34525 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-34525" }, "action_statement": "Vulnerability CVE-2026-34525 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34993 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-34993" }, "action_statement": "Vulnerability CVE-2026-34993 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47265 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-47265" }, "action_statement": "Vulnerability CVE-2026-47265 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50269 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-50269" }, "action_statement": "Vulnerability CVE-2026-50269 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54273 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54273" }, "action_statement": "Vulnerability CVE-2026-54273 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54274 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54274" }, "action_statement": "Vulnerability CVE-2026-54274 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54277 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54277" }, "action_statement": "Vulnerability CVE-2026-54277 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54278 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54278" }, "action_statement": "Vulnerability CVE-2026-54278 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54279 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-54279" }, "action_statement": "Vulnerability CVE-2026-54279 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post2+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59881 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59881" }, "action_statement": "Vulnerability CVE-2026-59881 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69243 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69243" }, "action_statement": "Vulnerability CVE-2026-69243 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69244 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-69244" }, "action_statement": "Vulnerability CVE-2026-69244 affects version 3.8.6.post2+tuxcare of aiohttp, and is fixed in 3.8.6.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-19T17:11:00.252404+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post2+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post2+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post2+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-21712 is fixed in version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2022-21712" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-24801 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-24801" }, "action_statement": "Vulnerability CVE-2022-24801 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-39348 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-39348" }, "action_statement": "Vulnerability CVE-2022-39348 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46137 is fixed in version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2023-46137" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41671 is fixed in version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41671" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41810 is fixed in version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2024-41810" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-09T06:10:06.243250+00:00", "status_notes": "Vulnerability CVE-2026-106454 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-106454" }, "action_statement": "Vulnerability CVE-2026-106454 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T20:55:55.110460+00:00", "status_notes": "Vulnerability CVE-2026-115774 affects version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-115774" }, "action_statement": "Vulnerability CVE-2026-115774 affects version 20.3.0.post4+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115775 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115775" }, "action_statement": "Vulnerability CVE-2026-115775 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115776 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115776" }, "action_statement": "Vulnerability CVE-2026-115776 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115778 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115778" }, "action_statement": "Vulnerability CVE-2026-115778 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-115877 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-115877" }, "action_statement": "Vulnerability CVE-2026-115877 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42304 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42304" }, "action_statement": "Vulnerability CVE-2026-42304 affects version 20.3.0.post4+tuxcare of twisted, and is fixed in 20.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T14:53:31.015773+00:00", "status_notes": "Vulnerability CVE-2026-83813 affects version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "CVE-2026-83813" }, "action_statement": "Vulnerability CVE-2026-83813 affects version 20.3.0.post4+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/twisted@20.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/twisted@20.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post4+tuxcare of twisted.", "vulnerability": { "name": "GHSA-vpp8-g58w-m8mp" }, "action_statement": "Vulnerability GHSA-vpp8-g58w-m8mp affects version 20.3.0.post4+tuxcare of twisted." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:26:12.093924+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 is fixed in version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 44.0.3.post3+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 44.0.3.post3+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 44.0.3.post3+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 44.0.3.post3+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:09:39.325728+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 44.0.3.post3+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "action_statement": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:52.980486+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 44.0.3. The vulnerability was fixed in upstream commit 9fbf84efc (2023-02-07) which added require_writable=True to prevent mutation of immutable buffers. This fix was already present in the upstream release that TuxCare onboarded. Additionally, the vulnerable Python implementation was completely replaced by a Rust implementation in commit 50ea0faab ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:26:12.093924+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is NOT AFFECTED by CVE-2023-49083. The vulnerable Python/CFFI implementation no longer exists; the upstream fix (commit 1e7b4d074 by alex.gaynor@gmail.com, Nov 27 2023) shipped in the upstream release before TuxCare onboarded this version. Additionally, the PKCS7 certificate loading code was later migrated to Rust (Jan 22 2024), which uses safe Option/Result patterns that ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 The target (cryptography 44.0.3.post4+tuxcare) is not vulnerable to CVE-2024-0727. While the cryptography library does process PKCS12 files and calls OpenSSL's vulnerable PKCS12_parse() functions via Rust bindings (src/rust/src/pkcs12.rs:726-741), the bundled OpenSSL 3.4.6 contains the fix for this vulnerability. CVE-2024-0727 was fixed in OpenSSL 3.2.1/3.1.5/3.0.13 (released Jan 30, 2024), and..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography versions 42.0.0-44.0.0 due to vulnerable OpenSSL bundled in wheels. Target version 44.0.3.post4+tuxcare is outside this range. Upstream released 44.0.1 on 2025-02-11 (same day as OpenSSL advisory 20250211.txt) with OpenSSL 3.4.1, removing the vulnerability. Version 44.0.3 inherited this fix. TuxCare's build currently uses OpenSSL 3.4.6 (even newer). The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post2+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 44.0.3.post1+tuxcare of cryptography, and is fixed in 44.0.3.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 44.0.3 is not affected by GHSA-5cpq-8wj7-hf2v (OpenSSL CVE-2023-2650). The CVE affected cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions. The target bundles OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh:13), which is newer than the fixed versions (1.1.1u, 3.0.9, 3.1.1) and does not contain the CVE-2023-2650 vulnerability. The vulnerable OpenSSL code is..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by CVE-2024-6119/GHSA-h4gh-qq45-vh27. This vulnerability exists in OpenSSL versions 3.0-3.3.1 and was fixed in OpenSSL 3.3.2. The target builds with OpenSSL 3.4.6 (per ci/scripts/install_openssl.sh), which is significantly newer than the fixed version and does not contain the vulnerability. The affected cryptography version range is 37.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:09:39.325728+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 44.0.3.post1+tuxcare of cryptography. not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target version (44.0.3.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE affects pyca/cryptography versions 0.8-41.0.2 due to vulnerable OpenSSL versions bundled in the wheels. The fix was introduced in version 41.0.3 (OpenSSL 3.1.2). The target version 44.0.3 ships with OpenSSL 3.4.1 (introduced in upstream version 44.0.1), which is much newer and includes all fixes for CVE-2..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@44.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@44.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "action_statement": "Vulnerability GHSA-v8gr-m533-ghj9 affects version 44.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-29T17:02:39.844038+00:00", "status_notes": "Vulnerability CVE-2023-37276 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-37276" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by CVE-2023-37276. The vulnerability (HTTP request smuggling via `\\r` characters in headers) existed in the bundled llhttp v6.0.6 parser in aiohttp \u22643.8.4. The upstream vendor fixed this in aiohttp v3.8.5 (July 2023) by upgrading to llhttp v8.1.1 (commit 40874103e). This fix was already present in the upstream 3.8.6 release before TuxCare ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-29T16:59:58.089624+00:00", "status_notes": "Vulnerability CVE-2023-47627 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-47627" }, "impact_statement": "not_affected \u2014 The target repository is not affected by CVE-2023-47627. All three vulnerability patterns (improper Content-Length parsing, NUL/CR/LF in header values, whitespace before colon) have been fixed in upstream commit d5c12ba890557a575c313bb3017910d7616fce3d (Oct 6, 2023), which was part of the upstream aiohttp 3.8 release before TuxCare started maintaining this version. The fix implements strict RFC..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2023-49081 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2023-49082 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2023-49082" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2024-23334 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23334" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2024-23829 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-23829" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2024-27306 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-27306" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2024-30251 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-30251" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2024-52304 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2024-52304" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-53643 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-53643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69223 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69223" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69224 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69224" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69225 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69225" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69226 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69226" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69227 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69227" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69228 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69228" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69229 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2025-69229" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2025-69230 does not affect version 3.8.6.post20+tuxcare of aiohttp. aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-69230" }, "impact_statement": "aiohttp 3.8.6 has no aiohttp/_cookie_helpers.py and BaseRequest.cookies performs no logging at all (web_request.py does not reference internal_logger); it parses with stdlib SimpleCookie. The per-cookie warning loop that upstream 64629a08 replaces with one aggregated debug line does not exist on this branch, so the log-flooding path is absent. Same determination as 3.8.5 (VPV 18638) and 3.8.4 (VPV 18628)." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111063 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111063" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111064 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111064" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111065 affects version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111065" }, "action_statement": "Vulnerability CVE-2026-111065 affects version 3.8.6.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111066 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111066" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability CVE-2026-111748 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111748" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111749 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-111749" }, "impact_statement": "not_affected \u2014 CVE-2026-111749 describes a vulnerability where \"a subdomain can remove the Host-Only flag from an existing cookie to a parent domain.\" After extensive code analysis of aiohttp 3.8.6, this vulnerability pattern is NOT present. The code properly maintains host-only cookie protection even when subdomains attempt to overwrite cookies with explicit domain attributes. The `_host_only_cookies` set is..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-111750 affects version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-111750" }, "action_statement": "Vulnerability CVE-2026-111750 affects version 3.8.6.post20+tuxcare of aiohttp." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-22815 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34513 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34513" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34514 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34514" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34515 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34515" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34516 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34516" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34517 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34517" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34518 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34518" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34519 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34519" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34520 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34520" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34525 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-34993 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-34993" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-47265 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-47265" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-50269 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-50269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54273 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54274 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54274" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54275 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54275" }, "impact_statement": "not_affected \u2014 CVE-2026-54275 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability requires the per-request server_hostname parameter feature, which was introduced in version 3.9.0 and does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54276 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54276" }, "impact_statement": "not_affected \u2014 The target repository (aiohttp version 3.8.6.post6+tuxcare) does not contain the DigestAuthMiddleware component that is affected by CVE-2026-54276. This feature was introduced in aiohttp version 3.12, but the target runs version 3.8.6. Without DigestAuthMiddleware, the cross-origin credential disclosure vulnerability cannot manifest." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54277 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54278 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54278" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54279 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-54279" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-54280 does not affect version 3.8.6.post20+tuxcare of aiohttp. Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54280" }, "impact_statement": "Version 3.8.6 is not vulnerable. Summary: CVE-2026-54280 does not affect aiohttp version 3.8.6.post6+tuxcare. The vulnerability is specific to versions that have the Payload.close() method (introduced in May 2025), which is absent in this version released in October 2023. The target version uses a different architecture where file-based payloads handle cleanup internally via finally blocks in their write() methods." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-59881 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-59881" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-69243 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69243" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability CVE-2026-69244 is fixed in version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "CVE-2026-69244" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-27T11:59:22.472791+00:00", "status_notes": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post20+tuxcare of aiohttp.", "vulnerability": { "name": "GHSA-2g87-pp6c-29x5" }, "action_statement": "Vulnerability GHSA-2g87-pp6c-29x5 affects version 3.8.6.post20+tuxcare of aiohttp." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/aiohttp@3.8.6.post20+tuxcare" } } ], "timestamp": "2026-10-29T16:48:42.304008+00:00", "status_notes": "Vulnerability GHSA-pjjw-qhg8-p2p9 does not affect version 3.8.6.post20+tuxcare of aiohttp. not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-pjjw-qhg8-p2p9" }, "impact_statement": "not_affected \u2014 The target aiohttp 3.8.6.post20+tuxcare is not affected by GHSA-pjjw-qhg8-p2p9. The vulnerability exists in llhttp 8.1.1 (two request smuggling flaws), but the target ships with llhttp 9.1.3 which contains the upstream fix. The llhttp upgrade to 9.1.3 was part of the upstream aiohttp 3.8.6 release (2023-10-07) that TuxCare onboarded, not a TuxCare backport. The fix commit bcc416e533 (authored b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:10:35.103463+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is not present in cryptography 43.0.3. The vulnerability was fixed in upstream version 39.0.1 (February 2023) by adding buffer writability validation. The target version 43.0.3 uses a Rust-based implementation that includes the fix: the `CffiMutBuf` type enforces `require_writable=True` when extracting mutable buffers, preventing immutable objects from being mutated. The fix comm..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Target version 43.0.3 uses a Rust implementation of PKCS7 certificate loading that inherently prevents NULL-pointer dereferences through memory-safe Option types and pattern matching. The vulnerability exists only in the Python OpenSSL backend (versions < 41.0.6), which was replaced by Rust in later versions. Test evidence confirms the PoC raises ValueError instead of crashing." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:17:04.150532+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions). The target repository (pyca/cryptography 43.0.3.post5+tuxcare) does NOT contain OpenSSL's vulnerable C source code - it only contains Python and Rust wrapper code that calls OpenSSL via the `openssl` Rust crate (declared dependency). The vulnerability exists exclusively in OpenSSL's C implementation, not i..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-39892 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-39892" }, "action_statement": "Vulnerability CVE-2026-39892 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 43.0.3.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 43.0.3.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 43.0.3.post1+tuxcare of cryptography, and is fixed in 43.0.3.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:38:31.252565+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 The target version cryptography 43.0.3 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 that bundled vulnerable OpenSSL versions in their wheels. The vulnerability was fixed in upstream version 41.0.0 (released 2023-05-30) by updating the bundled OpenSSL to version 3.1.1. The target version 43.0.3 is well beyond the vulnerable range and ships with OpenSS..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:02:14.489752+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target (cryptography 43.0.3.post5+tuxcare) is not affected by GHSA-h4gh-qq45-vh27 (OpenSSL CVE-2024-6119). The vulnerability affects OpenSSL versions bundled in cryptography wheels 37.0.0-43.0.0. The upstream fix (updating to OpenSSL 3.3.2) was released in cryptography 43.0.1 and is present in the target's git history as commit a7733878 authored by upstream maintainer Paul Kehrer. This fix ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is NOT affected by GHSA-jm77-qphf-c4w8. The CVE explicitly states the affected version range is \"cryptography 0.8-41.0.2\" (wheels bundling vulnerable OpenSSL < 3.1.2). The target version 43.0.3 was released in October 2024, 14 months after the fix (version 41.0.3, August 2023), and inherently bundles OpenSSL 3.3.2 or later, which already contains fixes for th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@43.0.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@43.0.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:31:42.930543+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 43.0.3.post1+tuxcare of cryptography. not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 Target version 43.0.3.post5+tuxcare is not affected by GHSA-v8gr-m533-ghj9 (CVE-2023-4807). This vulnerability affects OpenSSL versions bundled in cryptography wheels \u226441.0.3. The vulnerability is in OpenSSL (POLY1305 MAC XMM register corruption on Windows), not in cryptography's own code. The target: (1) is version 43.0.3, well after the fixed version 41.0.4 released 2023-09-19, (2) builds whe..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post6+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post6+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post6+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post6+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post6+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post6+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post6+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post6+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post8+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post8+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post8+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post8+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post8+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post8+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post8+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post8+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post8+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post8+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post8+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post8+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post8+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post8+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post8+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post8+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post8+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post8+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post10+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:48:18.198751+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post10+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2024-1681 does not affect version 4.0.2.post1+tuxcare of flask-cors. not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1681" }, "impact_statement": "not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6221 affects version 4.0.2.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6221" }, "action_statement": "Vulnerability CVE-2024-6221 affects version 4.0.2.post1+tuxcare of flask-cors." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6839 affects version 4.0.2.post1+tuxcare of flask-cors, and is fixed in 4.0.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-6839" }, "action_statement": "Vulnerability CVE-2024-6839 affects version 4.0.2.post1+tuxcare of flask-cors, and is fixed in 4.0.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6844 affects version 4.0.2.post1+tuxcare of flask-cors, and is fixed in 4.0.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-6844" }, "action_statement": "Vulnerability CVE-2024-6844 affects version 4.0.2.post1+tuxcare of flask-cors, and is fixed in 4.0.2.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 4.0.2.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6866" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post11+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post11+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post4+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post4+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post4+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post4+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post11+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T10:42:12.356721+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post11+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11392" }, "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11393" }, "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11394" }, "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-12720" }, "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1194" }, "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-2099" }, "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:56:36.802731+00:00", "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3263" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:52:52.459677+00:00", "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3264" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3777" }, "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3933" }, "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:57:53.604864+00:00", "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-5197" }, "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:59:00.126054+00:00", "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post4+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-6051" }, "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6638" }, "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6921" }, "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post4+tuxcare of transformers." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-1839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-4372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-5241 is fixed in version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-5241" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-80047 affects version 4.57.6.post4+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-80047" }, "action_statement": "Vulnerability CVE-2026-80047 affects version 4.57.6.post4+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9856 is fixed in version 4.57.6.post4+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-9856" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post5+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post5+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post5+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 46.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 46.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:28:53.758396+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 46.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 46.0.7.post3+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 46.0.7.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:58:00.157057+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 is fixed in version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 is fixed in version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69248" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 46.0.7.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:03:40.491421+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:33:45.788916+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 46.0.7.post3+tuxcare of cryptography. not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post6+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post6+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post6+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102271 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post6+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post6+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102274 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102275" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post6+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post6+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post6+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post6+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post6+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post6+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post6+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:59:00.082432+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post4+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post4+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:13:32.902959+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.16.0.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:21:11.498246+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.16.0.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.16.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.16.0.post1+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.16.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34141 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-34141" }, "action_statement": "Vulnerability CVE-2021-34141 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-41495" }, "action_statement": "Vulnerability CVE-2021-41495 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.16.0.post1+tuxcare of numpy, and is fixed in 1.16.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:52.072756+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 70.3.0.post1+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in package_index REL regex) is NOT present in setuptools 70.3.0. The vulnerable pattern `\\srel\\s*=\\s*` (unbounded whitespace quantifier enabling catastrophic backtracking) has been replaced with the fixed pattern `\\srel\\s{0,10}=\\s{0,10}` (bounded quantifier) at line 216 of setuptools/package_index.py. The fix was authored by upstream maintainer Jason R. Coombs (jaraco@jara...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 (ReDoS in package_index REL regex) is NOT present in setuptools 70.3.0. The vulnerable pattern `\\srel\\s*=\\s*` (unbounded whitespace quantifier enabling catastrophic backtracking) has been replaced with the fixed pattern `\\srel\\s{0,10}=\\s{0,10}` (bounded quantifier) at line 216 of setuptools/package_index.py. The fix was authored by upstream maintainer Jason R. Coombs (jaraco@jara..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 70.3.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 70.3.0.post1+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 70.3.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 70.3.0.post1+tuxcare of setuptools, and is fixed in 70.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 70.3.0.post1+tuxcare of setuptools, and is fixed in 70.3.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 70.3.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 70.3.0.post1+tuxcare of setuptools." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:45:00.428333+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post9+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post9+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post20+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post20+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post20+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post20+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post20+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post20+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post20+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post20+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post20+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-101917" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102267" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 1.7.1.post4+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:01:25.383481+00:00", "status_notes": "Vulnerability CVE-2026-102274 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102274" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:55:32.070148+00:00", "status_notes": "Vulnerability CVE-2026-102275 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102275" }, "impact_statement": "not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:40:00.157608+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:56:01.041112+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 1.7.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:26:00.574021+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 1.7.1.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post7+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post7+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post7+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post7+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post10+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post10+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post10+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post10+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post10+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:25:19.223832+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:56:00.100136+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.8.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post1+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:35:47.119139+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 is fixed in version 42.0.8.post1+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42...", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:30:57.264034+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.8.post1+tuxcare of cryptography. not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.3.2.post1+tuxcare of setuptools. not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.3.2.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.3.2.post1+tuxcare of setuptools." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post1+tuxcare" } } ], "timestamp": "2026-09-30T06:05:45.406697+00:00", "status_notes": "Vulnerability CVE-2025-47273 affects version 75.3.2.post1+tuxcare of setuptools, and is fixed in 75.3.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-47273" }, "action_statement": "Vulnerability CVE-2025-47273 affects version 75.3.2.post1+tuxcare of setuptools, and is fixed in 75.3.2.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.3.2.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.3.2.post1+tuxcare of setuptools, and is fixed in 75.3.2.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.3.2.post1+tuxcare of setuptools, and is fixed in 75.3.2.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post12+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post12+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post12+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.0.7.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.0.7.post1+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:05:58.294427+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.0.7.post1+tuxcare of urllib3. not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:13:58.377643+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.0.7.post1+tuxcare of urllib3. not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-37891" }, "action_statement": "Vulnerability CVE-2024-37891 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 2.0.7.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 2.0.7.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 2.0.7.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.0.7.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.0.7.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:12:00.131811+00:00", "status_notes": "Vulnerability CVE-2026-97688 does not affect version 2.0.7.post1+tuxcare of urllib3. not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-97688" }, "impact_statement": "not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 2.0.7.post1+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post4+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post4+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post4+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post4+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.32.3.post2+tuxcare of requests. not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:24:38.799299+00:00", "status_notes": "Vulnerability CVE-2024-35195 does not affect version 2.32.3.post2+tuxcare of requests. not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-35195" }, "impact_statement": "not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.32.3.post2+tuxcare of requests, and is fixed in 2.32.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.32.3.post2+tuxcare of requests, and is fixed in 2.32.3.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.32.3.post2+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post9+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post4+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post4+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post2+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.20.post2+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.8.0.post3+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.8.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.8.0.post3+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.8.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.8.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w is fixed in version 75.8.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post5+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post5+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post5+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post5+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post5+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post5+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post5+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post5+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post5+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post5+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post5+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post5+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post5+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post5+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post5+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post5+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post5+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post5+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post6+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post6+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post6+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post6+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post6+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post9+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post9+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post9+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post9+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post9+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post2+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post2+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post3+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-50181" }, "action_statement": "Vulnerability CVE-2025-50181 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post3+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.4.post3+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post1+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post1+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post1+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48523 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48523" }, "action_statement": "Vulnerability CVE-2026-48523 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48524" }, "action_statement": "Vulnerability CVE-2026-48524 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48525" }, "action_statement": "Vulnerability CVE-2026-48525 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post1+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6940 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post12+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post12+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post12+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37054 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post12+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post12+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post12+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post12+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post12+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post12+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post12+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post12+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post12+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post12+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post12+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post12+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post12+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post12+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post12+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post12+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post12+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post12+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post12+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post12+tuxcare" } } ], "timestamp": "2026-10-05T11:49:00.139704+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.9.1.post12+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post10+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post10+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post10+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post10+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-30T00:27:05.135813+00:00", "status_notes": "Vulnerability CVE-2026-101917 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-101917" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-30T01:08:30.473565+00:00", "status_notes": "Vulnerability CVE-2026-102267 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102267" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 1.7.1.post2+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:01:25.383481+00:00", "status_notes": "Vulnerability CVE-2026-102274 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102274" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:55:32.070148+00:00", "status_notes": "Vulnerability CVE-2026-102275 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102275" }, "impact_statement": "not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:40:00.157608+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 1.7.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:56:01.041112+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-29T07:30:18.436677+00:00", "status_notes": "Vulnerability CVE-2026-48525 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48525" }, "action_statement": "Vulnerability CVE-2026-48525 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 1.7.1.post2+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:26:00.574021+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 1.7.1.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post9+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post9+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-09-30T07:02:26.630643+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post6+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post6+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post6+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.26.4.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post10+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post10+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post10+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post10+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post10+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post10+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post10+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post10+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post10+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post11+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post11+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post11+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post11+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post12+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post12+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post12+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post12+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post9+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post9+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post9+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post9+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post9+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post16+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post16+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post16+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post16+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post16+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post16+tuxcare" } } ], "timestamp": "2026-10-09T09:59:00.174263+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post1+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post1+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post1+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-4263" }, "action_statement": "Vulnerability CVE-2024-4263 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post1+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post1+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post1+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-52967" }, "action_statement": "Vulnerability CVE-2025-52967 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post1+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post1+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post1+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post1+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post1+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post1+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post1+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post1+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post1+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post1+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post1+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post1+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post8+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:45:09.719878+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post16+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post16+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post16+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post16+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post16+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post16+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post16+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post16+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post16+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post8+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:56:00.095647+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post6+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post6+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post6+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post6+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post6+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.31.0.post2+tuxcare of requests. not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.31.0.post2+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.31.0.post2+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.31.0.post2+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.31.0.post2+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.31.0.post2+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post4+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post4+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post4+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post4+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post4+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.post4+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post2+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post2+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post2+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post2+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post2+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post14+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post14+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post14+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post14+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:43:00.079946+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post14+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post4+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post4+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post4+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post4+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post4+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post14+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post14+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post14+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post14+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post14+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post7+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post7+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post7+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post7+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post10+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post10+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post10+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post10+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post10+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post10+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post10+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post10+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post10+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post10+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post10+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post10+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post10+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post10+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post10+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post10+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post10+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post10+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post10+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.9.1.post10+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post7+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post7+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post1+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post1+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post1+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post1+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post1+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post1+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:52.072756+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 70.3.0.post2+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in package_index REL regex) is NOT present in setuptools 70.3.0. The vulnerable pattern `\\srel\\s*=\\s*` (unbounded whitespace quantifier enabling catastrophic backtracking) has been replaced with the fixed pattern `\\srel\\s{0,10}=\\s{0,10}` (bounded quantifier) at line 216 of setuptools/package_index.py. The fix was authored by upstream maintainer Jason R. Coombs (jaraco@jara...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 (ReDoS in package_index REL regex) is NOT present in setuptools 70.3.0. The vulnerable pattern `\\srel\\s*=\\s*` (unbounded whitespace quantifier enabling catastrophic backtracking) has been replaced with the fixed pattern `\\srel\\s{0,10}=\\s{0,10}` (bounded quantifier) at line 216 of setuptools/package_index.py. The fix was authored by upstream maintainer Jason R. Coombs (jaraco@jara..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 70.3.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 70.3.0.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 70.3.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 70.3.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@70.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@70.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 70.3.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 70.3.0.post2+tuxcare of setuptools." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11392" }, "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11393" }, "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11394" }, "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-12720" }, "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1194" }, "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-2099" }, "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:56:36.802731+00:00", "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3263" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:52:52.459677+00:00", "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3264" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3777" }, "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3933" }, "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:57:53.604864+00:00", "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-5197" }, "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:59:00.126054+00:00", "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post2+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-6051" }, "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6638" }, "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6921" }, "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post2+tuxcare of transformers." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-1839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post2+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-4372" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-5241 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-5241" }, "action_statement": "Vulnerability CVE-2026-5241 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-80047 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-80047" }, "action_statement": "Vulnerability CVE-2026-80047 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9856 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-9856" }, "action_statement": "Vulnerability CVE-2026-9856 affects version 4.57.6.post2+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-30T00:27:05.135813+00:00", "status_notes": "Vulnerability CVE-2026-101917 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-101917" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-30T01:08:30.473565+00:00", "status_notes": "Vulnerability CVE-2026-102267 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102267" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 1.7.1.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 1.7.1.post1+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:01:25.383481+00:00", "status_notes": "Vulnerability CVE-2026-102274 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102274" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:55:32.070148+00:00", "status_notes": "Vulnerability CVE-2026-102275 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102275" }, "impact_statement": "not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:40:00.157608+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:56:01.041112+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-29T07:30:18.436677+00:00", "status_notes": "Vulnerability CVE-2026-48525 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48525" }, "action_statement": "Vulnerability CVE-2026-48525 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 1.7.1.post1+tuxcare of pyjwt, and is fixed in 1.7.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:26:00.574021+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 1.7.1.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post18+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post18+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post18+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2023-41164 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post18+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post18+tuxcare" } } ], "timestamp": "2026-10-19T08:07:00.226964+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post13+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post13+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post13+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post13+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:32:00.148417+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-08T07:59:00.209245+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post2+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48524" }, "action_statement": "Vulnerability CVE-2026-48524 affects version 2.8.0.post2+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post2+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post2+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post3+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post3+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post3+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-4263" }, "action_statement": "Vulnerability CVE-2024-4263 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post3+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post3+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post3+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post3+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post3+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post3+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post3+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post3+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post3+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post3+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post3+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post3+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post3+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post3+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post3+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:12:00.150579+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post1+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post1+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-34141 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2021-34141" }, "action_statement": "Vulnerability CVE-2021-34141 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-41495" }, "action_statement": "Vulnerability CVE-2021-41495 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.15.4.post1+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.2.3.post4+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.2.3.post4+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-34069" }, "action_statement": "Vulnerability CVE-2024-34069 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.2.3.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 2.2.3.post4+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post7+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post7+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post7+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post7+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 68.0.0.post1+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 is not present in setuptools 68.0.0. The vulnerable regex pattern causing catastrophic backtracking DoS has been replaced with the fixed version. The fix (limiting whitespace matching from \\s* to \\s{0,10}) was introduced in upstream commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be by Jason R. Coombs and was already present in upstream release 65.5.1, which predates the target vers...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 is not present in setuptools 68.0.0. The vulnerable regex pattern causing catastrophic backtracking DoS has been replaced with the fixed version. The fix (limiting whitespace matching from \\s* to \\s{0,10}) was introduced in upstream commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be by Jason R. Coombs and was already present in upstream release 65.5.1, which predates the target vers..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 68.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 68.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 68.0.0.post1+tuxcare of setuptools, and is fixed in 68.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 68.0.0.post1+tuxcare of setuptools, and is fixed in 68.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 68.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 68.0.0.post1+tuxcare of setuptools." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2024-1681 does not affect version 4.0.2.post2+tuxcare of flask-cors. not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1681" }, "impact_statement": "not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6221 affects version 4.0.2.post2+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6221" }, "action_statement": "Vulnerability CVE-2024-6221 affects version 4.0.2.post2+tuxcare of flask-cors." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6839 affects version 4.0.2.post2+tuxcare of flask-cors, and is fixed in 4.0.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-6839" }, "action_statement": "Vulnerability CVE-2024-6839 affects version 4.0.2.post2+tuxcare of flask-cors, and is fixed in 4.0.2.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6844 is fixed in version 4.0.2.post2+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6844" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 4.0.2.post2+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6866" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:12:00.150579+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post3+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post3+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post3+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.15.4.post3+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.15.4.post3+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.15.4.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.15.4.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.15.4.post3+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.15.4.post3+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post2+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post2+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post2+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post2+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post2+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post2+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:25:19.223832+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:56:00.100136+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.8.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 42.0.8.post2+tuxcare of cryptography, and is fixed in 42.0.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 42.0.8.post2+tuxcare of cryptography, and is fixed in 42.0.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post2+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post2+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:35:47.119139+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 is fixed in version 42.0.8.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42...", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:30:57.264034+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.8.post2+tuxcare of cryptography. not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post3+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post3+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post7+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post7+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post7+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post7+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post7+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11392" }, "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11393" }, "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11394" }, "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-12720" }, "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1194" }, "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-2099" }, "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:56:36.802731+00:00", "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3263" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:52:52.459677+00:00", "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3264" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3777" }, "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3933" }, "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:57:53.604864+00:00", "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-5197" }, "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:59:00.126054+00:00", "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post5+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-6051" }, "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6638" }, "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6921" }, "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post5+tuxcare of transformers." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-1839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-4372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-5241 is fixed in version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-5241" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-80047 is fixed in version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-80047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-9856 is fixed in version 4.57.6.post5+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-9856" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.31.0.post1+tuxcare of requests. not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-35195 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-35195" }, "action_statement": "Vulnerability CVE-2024-35195 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-25645" }, "action_statement": "Vulnerability CVE-2026-25645 affects version 2.31.0.post1+tuxcare of requests, and is fixed in 2.31.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.8.0.post2+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.8.0.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.8.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.8.0.post2+tuxcare of setuptools, and is fixed in 75.8.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.8.0.post2+tuxcare of setuptools, and is fixed in 75.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post1+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "action_statement": "Vulnerability GHSA-56pw-mpj4-fxww affects version 9.4.0.post1+tuxcare of pillow, and is fixed in 9.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post6+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post6+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post6+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.3.8.post1+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.3.8.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.3.8.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.3.8.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.3.8.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-34069" }, "action_statement": "Vulnerability CVE-2024-34069 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49766" }, "action_statement": "Vulnerability CVE-2024-49766 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49767" }, "action_statement": "Vulnerability CVE-2024-49767 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 2.3.8.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 2.3.8.post1+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.0.7.post2+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:05:58.294427+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.0.7.post2+tuxcare of urllib3. not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:13:58.377643+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.0.7.post2+tuxcare of urllib3. not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 2.0.7.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.0.7.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.0.7.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:12:00.131811+00:00", "status_notes": "Vulnerability CVE-2026-97688 does not affect version 2.0.7.post2+tuxcare of urllib3. not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-97688" }, "impact_statement": "not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 2.0.7.post2+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post3+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post3+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post3+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post3+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.2.post3+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post13+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post13+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post13+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post13+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post13+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:12:00.150579+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post2+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post2+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post2+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.15.4.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-41495" }, "action_statement": "Vulnerability CVE-2021-41495 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.15.4.post2+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:13:32.902959+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.16.0.post2+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:21:11.498246+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.16.0.post2+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.16.0.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.16.0.post2+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.16.0.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34141 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-34141" }, "action_statement": "Vulnerability CVE-2021-34141 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2021-41495" }, "action_statement": "Vulnerability CVE-2021-41495 affects version 1.16.0.post2+tuxcare of numpy, and is fixed in 1.16.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-41496 is fixed in version 1.16.0.post2+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post1+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post1+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post1+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post1+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post1+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post4+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post4+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post4+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post7+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post7+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post7+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post7+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post7+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post7+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post7+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post7+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post7+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post7+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post7+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post7+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post7+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post7+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post7+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post7+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post7+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post7+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:13:32.902959+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.16.0.post3+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:21:11.498246+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.16.0.post3+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.16.0.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.16.0.post3+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.16.0.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 affects version 1.16.0.post3+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33430" }, "action_statement": "Vulnerability CVE-2021-33430 affects version 1.16.0.post3+tuxcare of numpy, and is fixed in 1.16.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.16.0.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.16.0.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-41496 is fixed in version 1.16.0.post3+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post9+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post9+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post9+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post9+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post2+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post2+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post2+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post2+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post2+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post2+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-2614" }, "action_statement": "Vulnerability CVE-2026-2614 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post2+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post2+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post2+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post2+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post2+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 46.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 46.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:28:53.758396+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 46.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 46.0.7.post2+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 46.0.7.post2+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:58:00.157057+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 is fixed in version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 46.0.7.post2+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 46.0.7.post2+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 46.0.7.post2+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:03:40.491421+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:33:45.788916+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 46.0.7.post2+tuxcare of cryptography. not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.5.0.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.5.0.post1+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:05:38.020126+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.5.0.post1+tuxcare of urllib3. not_affected \u2014 CVE-2023-43804 (Cookie header leakage via cross-origin redirects) is not present in urllib3 2.5.0.post2+tuxcare. The upstream fix (commit 644124ec by quentin.pradet@gmail.com) shipped in the 2.5.0 release before TuxCare onboarding. The defense adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be automatically stripped during cross-host redirects. This defense is ena...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 CVE-2023-43804 (Cookie header leakage via cross-origin redirects) is not present in urllib3 2.5.0.post2+tuxcare. The upstream fix (commit 644124ec by quentin.pradet@gmail.com) shipped in the 2.5.0 release before TuxCare onboarding. The defense adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be automatically stripped during cross-host redirects. This defense is ena..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.5.0.post1+tuxcare of urllib3. not_affected \u2014 The target urllib3 version 2.5.0.post2+tuxcare is NOT AFFECTED by CVE-2023-45803. The vulnerability (sending HTTP request body and content-specific headers to redirect targets on 303 status responses) does not exist in this version because the upstream vendor (urllib3 project) fixed it in versions 2.0.7 and 1.26.18, which predates TuxCare's onboarding of version 2.5.0. The complete defense is p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 version 2.5.0.post2+tuxcare is NOT AFFECTED by CVE-2023-45803. The vulnerability (sending HTTP request body and content-specific headers to redirect targets on 303 status responses) does not exist in this version because the upstream vendor (urllib3 project) fixed it in versions 2.0.7 and 1.26.18, which predates TuxCare's onboarding of version 2.5.0. The complete defense is p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 2.5.0.post1+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is NOT present in urllib3 2.5.0.post2+tuxcare. The vulnerability (leaking Proxy-Authorization header on cross-origin redirects) was fixed by upstream commit accff72e on June 17, 2024, which added \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT. This fix was already present in the upstream 2.5.0 release (June 18, 2025) that TuxCare onboarded. The target code at src/url...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is NOT present in urllib3 2.5.0.post2+tuxcare. The vulnerability (leaking Proxy-Authorization header on cross-origin redirects) was fixed by upstream commit accff72e on June 17, 2024, which added \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT. This fix was already present in the upstream 2.5.0 release (June 18, 2025) that TuxCare onboarded. The target code at src/url..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2025-50181 does not affect version 2.5.0.post1+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0 repository is NOT AFFECTED by CVE-2025-50181. The vulnerability was fixed in upstream commits f05b1329 and 7eb4a2aa, which were already present in the urllib3 2.5.0 release that TuxCare onboarded. Both the main fix (proper handling of the retries parameter in PoolManager.__init__ and using response.retries as fallback in urlopen) and the Emscripten/Node.js fix (setting ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50181" }, "impact_statement": "not_affected \u2014 The target urllib3 2.5.0 repository is NOT AFFECTED by CVE-2025-50181. The vulnerability was fixed in upstream commits f05b1329 and 7eb4a2aa, which were already present in the urllib3 2.5.0 release that TuxCare onboarded. Both the main fix (proper handling of the retries parameter in PoolManager.__init__ and using response.retries as fallback in urlopen) and the Emscripten/Node.js fix (setting ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:45:00.253277+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 2.5.0.post1+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0.post2+tuxcare is not affected by CVE-2025-50182. Both security fixes (PoolManager redirect control and Pyodide/Node.js Fetch API configuration) were already present in upstream urllib3 2.5.0 that TuxCare onboarded. The vulnerable pattern does not exist in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 The target urllib3 2.5.0.post2+tuxcare is not affected by CVE-2025-50182. Both security fixes (PoolManager redirect control and Pyodide/Node.js Fetch API configuration) were already present in upstream urllib3 2.5.0 that TuxCare onboarded. The vulnerable pattern does not exist in the target code." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-05T08:16:00.102934+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 2.5.0.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.5.0.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.5.0.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 2.5.0.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 2.5.0.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 2.5.0.post1+tuxcare of urllib3, and is fixed in 2.5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post8+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post8+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post8+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post8+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post8+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post7+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post7+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post10+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post10+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post10+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post10+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:00:05.020596+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post1+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post1+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.4.post1+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post6+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post6+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post6+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post6+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post6+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post5+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post5+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post5+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post5+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post5+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post5+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post5+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post5+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post5+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post5+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post5+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post5+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post5+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post5+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11392" }, "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11393" }, "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11394" }, "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-12720" }, "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1194" }, "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-2099" }, "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:56:36.802731+00:00", "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3263" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:52:52.459677+00:00", "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3264" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3777" }, "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3933" }, "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:57:53.604864+00:00", "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-5197" }, "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:59:00.126054+00:00", "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post1+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-6051" }, "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6638" }, "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6921" }, "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post1+tuxcare of transformers." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post1+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-1839" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4372 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-4372" }, "action_statement": "Vulnerability CVE-2026-4372 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-5241 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-5241" }, "action_statement": "Vulnerability CVE-2026-5241 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-80047 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-80047" }, "action_statement": "Vulnerability CVE-2026-80047 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9856 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-9856" }, "action_statement": "Vulnerability CVE-2026-9856 affects version 4.57.6.post1+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post7+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-101918 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post7+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post7+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102271 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post7+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post7+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102274 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-102275 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102275" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post7+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post7+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:31:53.609224+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 is fixed in version 2.10.1.post7+tuxcare of pyjwt.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.0.0.post2+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.0.0.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:25:00.246700+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:26:00.226980+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:30:11.126719+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.0.0.post2+tuxcare of setuptools, and is fixed in 75.0.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.0.0.post2+tuxcare of setuptools, and is fixed in 75.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post10+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post10+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post10+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post10+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post10+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post2+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post2+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post2+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post2+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post2+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post7+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post7+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "action_statement": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post5+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post5+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post5+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post5+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post5+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post5+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.4.post5+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post7+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post7+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post7+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post7+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post7+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post12+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post12+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post1+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post1+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post1+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post1+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post5+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post5+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post5+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post5+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.2.post5+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post2+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post2+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post15+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post15+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post15+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post15+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-27T11:03:21.163235+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post15+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post15+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post15+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.0.0.post3+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.0.0.post3+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:30:11.126719+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:30:11.126719+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:30:11.126719+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w is fixed in version 75.0.0.post3+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post15+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post15+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post15+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post15+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post15+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post15+tuxcare" } } ], "timestamp": "2026-10-08T10:54:28.280583+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post9+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T10:14:00.068840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post6+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post6+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post6+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post6+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post6+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post6+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post9+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post9+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post9+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post9+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post9+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post9+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post9+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post9+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post9+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post9+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post9+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post9+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post9+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post9+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.22.4.post9+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post5+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post5+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post5+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post5+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post9+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post9+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post9+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post9+tuxcare" } } ], "timestamp": "2026-10-07T11:07:00.154903+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post3+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post3+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post3+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post3+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post3+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post3+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post3+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post3+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post3+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post3+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post3+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post3+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post3+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post3+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post11+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post11+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post11+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post11+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post11+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post5+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post5+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post5+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post5+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post5+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post10+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post10+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post12+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post12+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post12+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post12+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post2+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post2+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post2+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post2+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T10:39:17.538071+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post13+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post13+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post12+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post12+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post12+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post12+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post12+tuxcare" } } ], "timestamp": "2026-10-09T10:14:00.086672+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:13:32.902959+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.16.0.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 affects NumPy before 1.8.1 due to insecure tempfile.mktemp() usage in f2py allowing symlink attacks. The target (NumPy 1.16.0) is NOT vulnerable. The fix was applied in upstream commit 0bb46c1448 by Julian Taylor, replacing mktemp() with secure alternatives: mkstemp() in numpy/f2py/__init__.py and mkdtemp() in numpy/f2py/f2py2e.py. This fix shipped in the upstream release before T..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:21:11.498246+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.16.0.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 affects NumPy before 1.8.1 via insecure tempfile.mktemp() usage allowing symlink attacks. The target (NumPy 1.16.0.post4+tuxcare) contains upstream fixes from NumPy 1.8.1 that remove vulnerable mktemp patterns. The fixes were authored by Julian Taylor (upstream) and shipped in NumPy 1.8.1 (Feb 2014), years before the 1.16.0 release that TuxCare onboarded. Current code uses secure ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.16.0.post4+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 is fixed in version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-33430" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.16.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.16.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-41496 is fixed in version 1.16.0.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post13+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post13+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post13+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post13+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post13+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post4+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post4+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post12+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post12+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post12+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post12+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post12+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post4+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post4+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.4.post4+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post10+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T10:12:25.191391+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post2+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post2+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post2+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post2+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post2+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post6+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post6+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post3+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post3+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post3+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post3+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post3+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.post3+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post5+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post5+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post5+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post5+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post5+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post3+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post3+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post3+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post3+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post3+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.20.post3+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post7+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post7+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post7+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post5+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post5+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post5+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post5+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.26.20.post5+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post1+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post1+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post1+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post1+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post1+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.20.post1+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.3.2.post2+tuxcare of setuptools. not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.3.2.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.3.2.post2+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:05:45.406697+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.3.2.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post2+tuxcare" } } ], "timestamp": "2026-09-30T06:05:45.406697+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.3.2.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.3.2.post2+tuxcare of setuptools, and is fixed in 75.3.2.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.3.2.post2+tuxcare of setuptools, and is fixed in 75.3.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post5+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post5+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post14+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post14+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post14+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post3+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post3+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post3+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post3+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post1+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post1+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post1+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post1+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post1+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post6+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post6+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post6+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post6+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post6+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post6+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post6+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post6+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post6+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post6+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post6+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post4+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post4+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post4+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post4+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.2.post4+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post9+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post9+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post9+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post9+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post10+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post10+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post10+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post10+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post10+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post10+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post18+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post18+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post18+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post18+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post18+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post18+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post18+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post18+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post18+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post8+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.3.8.post3+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.3.8.post3+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.3.8.post3+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.3.8.post3+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.3.8.post3+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 2.3.8.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-23T11:03:11.209964+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post12+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post12+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post1+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post1+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post1+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post1+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post1+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.2.post1+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post11+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post11+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-24T04:14:16.874312+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post2+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.9.post2+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post4+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post4+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post4+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-4263" }, "action_statement": "Vulnerability CVE-2024-4263 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post4+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post4+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post4+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post4+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post4+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post4+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post4+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post4+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post4+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post4+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post4+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post4+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post4+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post4+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post4+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.32.3.post3+tuxcare of requests. not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:24:38.799299+00:00", "status_notes": "Vulnerability CVE-2024-35195 does not affect version 2.32.3.post3+tuxcare of requests. not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-35195" }, "impact_statement": "not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.32.3.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.32.3.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post9+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post9+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post13+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post13+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post13+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post13+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:28:00.156304+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post5+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post5+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22815" }, "action_statement": "Vulnerability CVE-2022-22815 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22816" }, "action_statement": "Vulnerability CVE-2022-22816 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post3+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post3+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post3+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "action_statement": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post3+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post11+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post11+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post11+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post11+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post11+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post11+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post11+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post11+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post11+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post11+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.3.8.post4+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.3.8.post4+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.3.8.post4+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-102598" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 2.3.8.post4+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T09:56:06.906739+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post7+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post7+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:15:15.579161+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability concerned insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448 by Julian Taylor) replaced mktemp() with secure alternatives (NamedTemporaryFile/mkdtemp) and was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. Comprehensive search confirms no ins...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability concerned insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448 by Julian Taylor) replaced mktemp() with secure alternatives (NamedTemporaryFile/mkdtemp) and was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. Comprehensive search confirms no ins..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:21:11.498246+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability (symlink attack via insecure tempfile.mktemp() usage) was fixed by upstream NumPy in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with atomic file creation functions (NamedTemporaryFile, mkdtemp). This fix was already present in the upstream NumPy 2.0.2 release when TuxCare onboarded it in April 20...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 is not present in NumPy 2.0.2.post1+tuxcare. The vulnerability (symlink attack via insecure tempfile.mktemp() usage) was fixed by upstream NumPy in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with atomic file creation functions (NamedTemporaryFile, mkdtemp). This fix was already present in the upstream NumPy 2.0.2 release when TuxCare onboarded it in April 20..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 2.0.2.post1+tuxcare of numpy." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2019-6446 affects version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" }, "action_statement": "Vulnerability CVE-2019-6446 affects version 2.0.2.post1+tuxcare of numpy." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:56:00.273139+00:00", "status_notes": "Vulnerability CVE-2021-33430 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-33430 is not present in NumPy 2.0.2. The vulnerability (buffer overflow in PyArray_NewFromDescr_int when processing arrays with excessive dimensions) was fixed in upstream commit 16f7824b4d (May 2021) by moving dimension validation before subarray buffer access. This fix was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. The target code at numpy/_core/src/...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33430" }, "impact_statement": "not_affected \u2014 CVE-2021-33430 is not present in NumPy 2.0.2. The vulnerability (buffer overflow in PyArray_NewFromDescr_int when processing arrays with excessive dimensions) was fixed in upstream commit 16f7824b4d (May 2021) by moving dimension validation before subarray buffer access. This fix was already included in the upstream NumPy 2.0.2 release that TuxCare onboarded. The target code at numpy/_core/src/..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:46:00.153285+00:00", "status_notes": "Vulnerability CVE-2021-34141 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-34141 describes an incomplete string comparison vulnerability in NumPy's dtype parsing that allowed attackers to bypass validation using crafted strings with matching prefixes (e.g., \"Bytes123\" matching \"Bytes\"). The target repository (NumPy 2.0.2.post1+tuxcare) is not affected because the vulnerable code was completely removed by upstream commit eeef9d4646103c3b1afd3085f1393f2b3f9575b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34141" }, "impact_statement": "not_affected \u2014 CVE-2021-34141 describes an incomplete string comparison vulnerability in NumPy's dtype parsing that allowed attackers to bypass validation using crafted strings with matching prefixes (e.g., \"Bytes123\" matching \"Bytes\"). The target repository (NumPy 2.0.2.post1+tuxcare) is not affected because the vulnerable code was completely removed by upstream commit eeef9d4646103c3b1afd3085f1393f2b3f9575b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:51:48.038559+00:00", "status_notes": "Vulnerability CVE-2021-41495 does not affect version 2.0.2.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-41495 is NOT present in numpy 2.0.2. The vulnerability (null pointer dereference due to missing return-value validation for PyArray_DescrNew and related functions) was fixed upstream in commit ac87f071f5 (Feb 2022, PR #20960). This fix was already included in the upstream numpy 2.0.2 release (July 2024) that TuxCare onboarded in April 2026. All required NULL checks are present in the t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-41495" }, "impact_statement": "not_affected \u2014 CVE-2021-41495 is NOT present in numpy 2.0.2. The vulnerability (null pointer dereference due to missing return-value validation for PyArray_DescrNew and related functions) was fixed upstream in commit ac87f071f5 (Feb 2022, PR #20960). This fix was already included in the upstream numpy 2.0.2 release (July 2024) that TuxCare onboarded in April 2026. All required NULL checks are present in the t..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 2.0.2.post1+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10001 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10001" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10002 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10002" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10003 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10003" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10004 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10004" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10005 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10006 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10006" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10007 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.0.2.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.0.2.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:16:27.073276+00:00", "status_notes": "Vulnerability TUXVUL-2026-10008 is fixed in version 2.0.2.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10008" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post9+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post9+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post9+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post9+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post9+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post9+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post9+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post9+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post9+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post9+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post9+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post9+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post9+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post9+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post9+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post9+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post9+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post9+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post9+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.9.1.post9+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post13+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post13+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post13+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post13+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post13+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.32.3.post1+tuxcare of requests. not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 CVE-2023-32681 (Proxy-Authorization header leak to HTTPS destinations) is not present in target version 2.32.3. The vulnerability was fixed upstream in v2.31.0 via commit 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 by nate.prewitt@gmail.com. The fix prevents attaching Proxy-Authorization headers to HTTPS-destined requests by adding the condition `if not scheme.startswith(\"https\")` in the rebuild_p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:24:38.799299+00:00", "status_notes": "Vulnerability CVE-2024-35195 does not affect version 2.32.3.post1+tuxcare of requests. not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-35195" }, "impact_statement": "not_affected \u2014 CVE-2024-35195 affects requests versions prior to 2.32.0. The target is at version 2.32.3.post3+tuxcare, which includes the upstream fix from commit c0813a2d (merged in v2.32.0). The fix modifies connection pool selection to include TLS verification settings (cert_reqs, ca_certs), preventing verify=False connections from being reused for verify=True requests. The vulnerable code pattern is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-47081 affects version 2.32.3.post1+tuxcare of requests, and is fixed in 2.32.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-47081" }, "action_statement": "Vulnerability CVE-2024-47081 affects version 2.32.3.post1+tuxcare of requests, and is fixed in 2.32.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/requests@2.32.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.32.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 affects version 2.32.3.post1+tuxcare of requests, and is fixed in 2.32.3.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-25645" }, "action_statement": "Vulnerability CVE-2026-25645 affects version 2.32.3.post1+tuxcare of requests, and is fixed in 2.32.3.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post11+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post11+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post11+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2025-15381 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15381" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post11+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post11+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post11+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post11+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2734" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post11+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post11+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post11+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-8147 is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post11+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.22.4.post11+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post7+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post7+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post7+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post7+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post7+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post7+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post2+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post2+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post2+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post2+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post2+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.post2+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.31.0.post3+tuxcare of requests. not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.31.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.31.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.31.0.post3+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post6+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post6+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post6+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post6+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:12:00.150579+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post5+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post5+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post5+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-33430 is fixed in version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-33430" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41496 is fixed in version 1.15.4.post5+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22815" }, "action_statement": "Vulnerability CVE-2022-22815 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22816" }, "action_statement": "Vulnerability CVE-2022-22816 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post1+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post1+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post1+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "action_statement": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post1+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post1+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post1+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post1+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post3+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post3+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post3+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post2+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post2+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post2+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post2+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.2.post2+tuxcare of django, and is fixed in 5.0.2.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post3+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post3+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:54:41.475097+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post8+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post6+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post6+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post6+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post6+tuxcare" } } ], "timestamp": "2026-10-06T10:08:48.714784+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.26.20.post6+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post12+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post12+tuxcare" } } ], "timestamp": "2026-10-26T10:11:47.844603+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post12+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post1+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.9.post1+tuxcare of django, and is fixed in 5.1.9.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post2+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post2+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post2+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-4263" }, "action_statement": "Vulnerability CVE-2024-4263 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post2+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post2+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post2+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post2+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post2+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post2+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post2+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post2+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post2+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post2+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post2+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post2+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post2+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post2+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post2+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post2+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post2+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post13+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post13+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post13+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post13+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post13+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112401 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-114501" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.3.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post12+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T14:21:49.793157+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post12+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post3+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post3+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post3+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post3+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post4+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.9.post4+tuxcare of django, and is fixed in 5.1.9.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post8+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post8+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post8+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post1+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post1+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post1+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-32597" }, "action_statement": "Vulnerability CVE-2026-32597 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post1+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48524" }, "action_statement": "Vulnerability CVE-2026-48524 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post1+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48526" }, "action_statement": "Vulnerability CVE-2026-48526 affects version 2.8.0.post1+tuxcare of pyjwt, and is fixed in 2.8.0.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post1+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post12+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post12+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post12+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post12+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post12+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post12+tuxcare" } } ], "timestamp": "2026-10-07T13:27:00.117429+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 65.5.1.post1+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 affects setuptools \u226465.5.0 due to a ReDoS vulnerability in the REL regex pattern in package_index.py. The target version 65.5.1 contains the upstream fix (commit 43a9c9bfa) that limits whitespace matching to prevent catastrophic backtracking. This fix was authored by Jason R. Coombs (jaraco@jaraco.com) and shipped in the upstream 65.5.1 release, which TuxCare subsequently onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 affects setuptools \u226465.5.0 due to a ReDoS vulnerability in the REL regex pattern in package_index.py. The target version 65.5.1 contains the upstream fix (commit 43a9c9bfa) that limits whitespace matching to prevent catastrophic backtracking. This fix was authored by Jason R. Coombs (jaraco@jaraco.com) and shipped in the upstream 65.5.1 release, which TuxCare subsequently onboard..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 65.5.1.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 affects version 65.5.1.post1+tuxcare of setuptools, and is fixed in 65.5.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-47273" }, "action_statement": "Vulnerability CVE-2025-47273 affects version 65.5.1.post1+tuxcare of setuptools, and is fixed in 65.5.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 65.5.1.post1+tuxcare of setuptools, and is fixed in 65.5.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 65.5.1.post1+tuxcare of setuptools, and is fixed in 65.5.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 65.5.1.post1+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 65.5.1.post1+tuxcare of setuptools." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:25:00.405081+00:00", "status_notes": "Vulnerability CVE-2024-1681 does not affect version 5.0.1.post1+tuxcare of flask-cors. not_affected \u2014 CVE-2024-1681 (log injection via CRLF in request path) is NOT present in flask-cors 5.0.1.post1+tuxcare. The vulnerable code pattern (using '%s' format specifier to log request.path) was fixed by upstream commit 6172c2000dba965fedb8e9a8a916ad56f0fb2630 authored by Anes Hujevi\u0107 on May 4, 2024. This fix was included in the upstream 5.0.1 release before TuxCare onboarded the version on commit 16c3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1681" }, "impact_statement": "not_affected \u2014 CVE-2024-1681 (log injection via CRLF in request path) is NOT present in flask-cors 5.0.1.post1+tuxcare. The vulnerable code pattern (using '%s' format specifier to log request.path) was fixed by upstream commit 6172c2000dba965fedb8e9a8a916ad56f0fb2630 authored by Anes Hujevi\u0107 on May 4, 2024. This fix was included in the upstream 5.0.1 release before TuxCare onboarded the version on commit 16c3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6221 affects version 5.0.1.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6221" }, "action_statement": "Vulnerability CVE-2024-6221 affects version 5.0.1.post1+tuxcare of flask-cors." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6839 is fixed in version 5.0.1.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6844 is fixed in version 5.0.1.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6844" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@5.0.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 5.0.1.post1+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6866" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post7+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post7+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post7+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post7+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post7+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.26.4.post7+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in cryptography 46.0.7. The vulnerability (allowing `Cipher.update_into()` to mutate immutable buffers) was fixed in upstream commit 9fbf84efc (Feb 2023) by adding `require_writable=True` to buffer validation. This fix shipped in the upstream release before TuxCare onboarding. In version 46.0.7, the cipher implementation uses Rust, where the equivalent fix is prese..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:28:53.758396+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 Version 46.0.7 is not affected by CVE-2023-49083. The vulnerability (NULL-pointer dereference in PKCS7 certificate loading) existed in the Python/OpenSSL backend implementation used in versions prior to 41.0.6. Version 46.0.7 uses a completely different architecture: PKCS7 functionality is implemented in Rust (src/rust/src/pkcs7.rs) using memory-safe Option types. The malicious input (PKCS7 wit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:51.534017+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability, not a pyca/cryptography vulnerability. The target repository (pyca/cryptography 46.0.7) does not contain OpenSSL source code\u2014it declares OpenSSL as a dependency via Rust FFI bindings. The vulnerable PKCS12 parsing code lives in the OpenSSL C library, not in this repository. The upstream patch only updated CI to test against patched OpenSSL versions (no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:24:37.696326+00:00", "status_notes": "Vulnerability CVE-2024-12797 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-12797" }, "impact_statement": "not_affected \u2014 CVE-2024-12797 affects pyca/cryptography 42.0.0-44.0.0 due to a vulnerability in the statically linked OpenSSL (versions 3.2.0-3.4.1) bundled in their wheels. The vulnerability involves OpenSSL's Raw Public Keys (RPKs) for server authentication, allowing MITM attacks when TLS/DTLS handshakes fail to abort on authentication failures. The target version 46.0.7.post3+tuxcare is outside the vulnera..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2026-26007 affects version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" }, "action_statement": "Vulnerability CVE-2026-26007 affects version 46.0.7.post1+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2026-34073 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-34073" }, "impact_statement": "not_affected \u2014 The target repository at version 46.0.7.post3+tuxcare is NOT AFFECTED by CVE-2026-34073. The fix for this vulnerability was already present in the upstream 46.0.7 release (commit 91d728897, authored by William Woodruff on 2026-03-25) that TuxCare onboarded. The vulnerable pattern (improper handling of wildcard DNS SANs against name constraints) has been removed. The target contains an even more..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:58:00.157057+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 46.0.7.post3+tuxcare) is not affected by CVE-2026-39892. The vulnerability involves buffer overflows when non-contiguous Python buffers are passed to APIs like Hash.update() on Python 3.11+. The fix (contiguity check in _extract_buffer_length) is present in the target code at src/rust/src/buf.rs lines 41-45. This fix was included in the upstream 46.0.7 releas..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-69248" }, "action_statement": "Vulnerability CVE-2026-69248 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-69249" }, "action_statement": "Vulnerability CVE-2026-69249 affects version 46.0.7.post1+tuxcare of cryptography, and is fixed in 46.0.7.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 46.0.7.post1+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:41:00.784384+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by CVE-2023-2650/GHSA-5cpq-8wj7-hf2v. The vulnerability concerns bundled OpenSSL versions in cryptography wheels for versions 0.5-40.0.2. The upstream fix (commit 8708245cc) updated bundled OpenSSL to patched versions (1.1.1u, 3.0.9, 3.1.1) and was already present in upstream release 46.0.7 before TuxCare onboarded this version. Current CI configuration use..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:03:40.491421+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" }, "impact_statement": "not_affected \u2014 The target version cryptography 46.0.7.post3+tuxcare is not affected by GHSA-h4gh-qq45-vh27. This CVE concerns OpenSSL CVE-2024-6119 (denial of service via malformed X.509 otherName SANs) that was bundled in cryptography wheels versions 37.0.0-43.0.0. The vulnerability was fixed in cryptography 43.0.1 by rebuilding wheels with OpenSSL 3.3.2+. The target version 46.0.7 (released 2026-01-27) bund..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:14:06.675817+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 Target version 46.0.7 is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions (<3.1.2) statically linked in cryptography's binary wheels for versions 0.8-41.0.2. The vulnerability is NOT in cryptography's Python/Rust source code but in the bundled OpenSSL library. Version 46.0.7 is far beyond the affected range (41.0.2), and both the upstream release and TuxCare..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@46.0.7.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@46.0.7.post1+tuxcare" } } ], "timestamp": "2026-10-29T16:33:45.788916+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 46.0.7.post1+tuxcare of cryptography. not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 The target version (46.0.7.post3+tuxcare) is not affected by GHSA-v8gr-m533-ghj9. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheels for versions 2.5-41.0.3. The target version 46.0.7 is significantly newer than the affected range and inherited the fix (OpenSSL 3.1.3+) from its upstream release. The vulnerability is in the bundled OpenSSL dependency distributed in whee..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post5+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post5+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post5+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post11+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post11+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post11+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post11+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post11+tuxcare" } } ], "timestamp": "2026-10-08T11:06:00.357662+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.2.3.post5+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.2.3.post5+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 2.2.3.post5+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 2.2.3.post5+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.2.3.post5+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.2.3.post5+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 2.2.3.post5+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post3+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post3+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post3+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post3+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6940 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post13+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3099" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37054 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post13+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post13+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post13+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post13+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post13+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post13+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post13+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post13+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post13+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post13+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post13+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2734" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post13+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post13+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post13+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post13+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post13+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post13+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.9.1.post13+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post14+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:44:00.082827+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post9+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post9+tuxcare" } } ], "timestamp": "2026-10-09T09:02:03.302817+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.0.7.post3+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:05:58.294427+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.0.7.post3+tuxcare of urllib3. not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:13:58.377643+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.0.7.post3+tuxcare of urllib3. not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 2.0.7.post3+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.0.7.post3+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.0.7.post3+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 2.0.7.post3+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 2.0.7.post3+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:12:00.131811+00:00", "status_notes": "Vulnerability CVE-2026-97688 does not affect version 2.0.7.post3+tuxcare of urllib3. not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-97688" }, "impact_statement": "not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 2.0.7.post3+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 2.0.7.post3+tuxcare of urllib3, and is fixed in 2.0.7.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.2.3.post6+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.2.3.post6+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2023-46136 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-102598" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-21860 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-21860" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post6+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-27199 is fixed in version 2.2.3.post6+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2026-27199" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post2+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post2+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.4.post2+tuxcare of django, and is fixed in 5.1.4.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post10+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post10+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-22T05:53:46.705420+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T12:11:18.551728+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post17+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post17+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post17+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post1+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post1+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post1+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post2+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post2+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post8+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post8+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post8+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-01T04:50:02.038518+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.2.post8+tuxcare of django, and is fixed in 5.0.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post8+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post8+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post8+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post1+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post1+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post1+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post1+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post1+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post1+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.post1+tuxcare of django, and is fixed in 5.1.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post14+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-114501" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96639 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96643 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96644 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 11.2.1.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post14+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post14+tuxcare" } } ], "timestamp": "2026-10-27T11:27:32.377366+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post14+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 2.2.3.post1+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 2.2.3.post1+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.2.3.post1+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.2.3.post1+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.2.3.post1+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-34069" }, "action_statement": "Vulnerability CVE-2024-34069 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49766" }, "action_statement": "Vulnerability CVE-2024-49766 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49767" }, "action_statement": "Vulnerability CVE-2024-49767 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 2.2.3.post1+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post9+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post9+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post9+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post9+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post9+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post9+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post9+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post9+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post9+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post9+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post9+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2021-33503 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post8+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post8+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post8+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post8+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:58:24.882958+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 1.26.4.post8+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post4+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post4+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post4+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post4+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post4+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post4+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post4+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post4+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post4+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post4+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post4+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post4+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.20.post4+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:05:31.880608+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 1.26.20.post4+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20.post6+tuxcare is not affected by CVE-2023-43804. The vulnerability involved Cookie headers being leaked during cross-host HTTP redirects. The fix (adding \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was introduced in upstream release 1.26.17 via commit 01220354 by Seth Michael Larson. Since the target is based on upstream 1.26.20, the fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 1.26.20.post4+tuxcare of urllib3. not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 1.26.20 is not affected by CVE-2023-45803. The vulnerability (failure to strip request body on 303 redirects) was fixed in upstream urllib3 v1.26.18 (released 2023-10-17), and that fix is present in the target version 1.26.20. The fix commit b594c5ceaca38e1ac215f916538fb128e3526a36 was authored by upstream developer Illia Volochii and shipped in the upstream release that TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 1.26.20.post4+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is not affecting this target. The vulnerability involved Proxy-Authorization headers being leaked on cross-origin redirects. The fix (adding \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT) was applied by upstream author Quentin Pradet in version 1.26.19 (June 17, 2024). Version 1.26.20, released August 29, 2024, inherited this fix before TuxCare onboarded it. The tar..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:49:00.121659+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.20.post4+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 concerns urllib3's redirect control behavior specifically in Pyodide runtime environments. Version 1.26.20 predates the addition of Emscripten/Pyodide support to urllib3 and contains no Pyodide-related code paths. The vulnerability requires urllib3 to be used in a Pyodide runtime context, which is not possible in this version. Therefore, this CVE does not apply to version 1.26.20." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.20.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.20.post4+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.20.post4+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.20.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.20.post4+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.20.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.20.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:30:26.237167+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.20.post4+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.20.post4+tuxcare of urllib3, and is fixed in 1.26.20.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.2.post11+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:06:40.250315+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed by upstream Django in version 4.0.1 (January 2022), over 2 years before Django 5.0.2 was released (February 2024). All required defenses are present in the target: backslash normalization, path traversal detection via \"..\" checks, os.path.relpath() to ensure relative paths, and trip..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-29T19:54:58.809918+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Target Django 5.0.2 is not affected by CVE-2022-22818. The vulnerability (unescaped HTML output in {% debug %} template tag leading to XSS) is not present because the upstream Django fix was already included in the 5.0.2 release. The DebugNode.render() method contains both security measures: (1) early return when DEBUG=False, and (2) HTML escaping via escape() on all pformat outputs. CVE affect..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.0.2.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.2 uses the original simple trim_punctuation implementation that lacks the vulnerable code pattern. CVE-2024-41990's DoS vulnerability was introduced by the CVE-2024-38875 fix (commit d666457453, June 2024) which replaced the simple implementation with a complex CountsDict-based one containing repeated rfind('&') calls. The target version predates this architectural change and therefo..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.2.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.2.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.2.post11+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.2.post11+tuxcare of django, and is fixed in 5.0.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.2.post11+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.2.post11+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.2.post11+tuxcare of django. not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.2 is not affected by CVE-2026-53878. The vulnerable code (DomainNameValidator class) does not exist in this version - it was introduced in Django 5.1. Django 5.0.2 uses _simple_domain_name_validator which already validates against newlines via string.whitespace." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.2.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.2.post11+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.2.post11+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6940 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post11+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-1594 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post11+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post11+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post11+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post11+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-1474 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-1474" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post11+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post11+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post11+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post11+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post11+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post11+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post11+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post11+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post11+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post11+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post11+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post11+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post11+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post11+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post11+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post11+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post11+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post11+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.9.1.post11+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post1+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.1.10.post1+tuxcare of django, and is fixed in 5.1.10.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-102274 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post4+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post4+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:25:00.094068+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post4+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6709 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6753 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6831 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2023-6831" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6909 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6974 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6975 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-6976 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 patches already applied in target branch", "vulnerability": { "name": "CVE-2023-6976" }, "impact_statement": "already_fixed \u2014 patches already applied in target branch" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-6977 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1483 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1558 does not affect version 2.9.1.post6+tuxcare of mlflow. Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')", "vulnerability": { "name": "CVE-2024-1558" }, "impact_statement": "Patches already applied: 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 (already in target via c8405983e7 'Backport CVE-2024-8859 to 2.9.1')" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1560 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2024-1560" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1593 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27132 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27133 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27134 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-2928 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2024-3099 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-3099" }, "action_statement": "Vulnerability CVE-2024-3099 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-3573 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37052 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37052" }, "impact_statement": "already_fixed \u2014 The target MLflow 2.9.1 codebase contains the fix for CVE-2024-37052 (unsafe pickle deserialization in scikit-learn model loading). The MLFLOW_ALLOW_PICKLE_DESERIALIZATION environment variable check was added in prior TuxCare backports (commits d58ee98ca for initial guard, 98a32847a for CVE-2024-37056, cf8bc9c26 for CVE-2024-37053). However, the defense defaults to True (allowing deserializatio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37053 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37055 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37056 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37057 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37057" }, "impact_statement": "already_fixed \u2014 CVE-2024-37057 (TensorFlow custom_objects cloudpickle): upstream has no 'fixed' version; its remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#21404, commit dd73d16). tuxcare-current/2.9.1 carries it: cf8bc9c262 (MR !36) = upstream dd73d16, mlflow/tensorflow/__init__.py:537-546 raises when the flag is false; shipped in 2.9.1.post9+tuxcare and later. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37058 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 CVE-2024-37059 (PyTorch torch.load pickle): upstream remediation is the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control (mlflow#20267 + #21404). tuxcare-current/2.9.1 carries it: 98a32847aa (= upstream #20267) and cf8bc9c262 (= dd73d16); mlflow/pytorch/__init__.py:598-615 `_load_by_pickle_check` runs before every torch.load. Shipped in 2.9.1.post10+tuxcare and earlier. Same conclusion as 2.22.4 VPV 18605 (not_affected, already_fixed). Was parked behind leader 18605. Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37060 does not affect version 2.9.1.post6+tuxcare of mlflow. CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37060" }, "impact_statement": "CVE-2024-37060 (Recipes): no upstream fix exists (GHSA-cv6c-7963-wxcg, no patched version). MLflow Recipes executes user-supplied code referenced from recipe.yaml and unpickles its own step outputs (mlflow/recipes/steps/train.py:380, mlflow/recipes/cards/__init__.py:227); running an untrusted recipe is by design equivalent to running untrusted code. Upstream never hardened this path and removed the Recipes feature entirely in MLflow 3.0 (commit 5f3334fa4f, 2025-04-29). Same decision as mlflow 2.22.4 (PYELSCVE-435 Won't Fix, Aikido informed 2025-12-18). Reviewed by esultanaliev 2026-09-24." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37061 does not affect version 2.9.1.post6+tuxcare of mlflow. CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24.", "vulnerability": { "name": "CVE-2024-37061" }, "impact_statement": "CVE-2024-37061 (MLproject code execution): no upstream fix exists \u2014 GHSA-pqcv-qw2r-r859 has no patched version and mlflow/mlflow#12257 (2024-06-05) is still open without maintainer response. The MLproject entry-point `command` is a shell string executed via `bash -c` by design (mlflow/projects/_project_spec.py:232, mlflow/projects/backend/local.py:274); running an untrusted MLproject is equivalent to running an untrusted script, and upstream master adds no validation to this path. Mitigation is operational (only run trusted projects), as communicated to Aikido on 2025-12-18 for mlflow 2.22.4 (PYELSCVE-436 Won't Fix). The bot's 'patches already applied via c8405983e' mapping was wrong: that commit is the CVE-2024-8859 registry path-traversal fix in mlflow/server/handlers.py, unrelated to Projects. Reviewed by esultanaliev 2026-09-24." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-4263 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-4263" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6838 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-8859 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-0453 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-0453" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11200 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-11201 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-1474 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-1474" }, "action_statement": "Vulnerability CVE-2025-1474 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2025-15031" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.9.1.post6+tuxcare of mlflow. Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Upstream 3bf6d81a adds check_tarfile_security() and wires it into mlflow/pyfunc/dbconnect_artifact_cache.py, which does not exist on 2.9.1. There is no tar extraction path on the branch at all: every tarfile.open() in mlflow/ is a write (\"w:gz\" in sagemaker/__init__.py, \"w\" in file_utils.py) and both extractall() calls are zipfile, not tarfile. MR !54 carried only the helper and its tests, leaving dead code with no caller; it has been reverted." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.9.1.post6+tuxcare of mlflow. CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "CVE-2025-15379 names _install_model_dependencies_to_env() under env_manager=LOCAL, which reads dependency strings from the model's python_env.yaml and interpolates them into a shell command. That function, the LOCAL env-manager branch, and any python_env.yaml read are all absent from mlflow 2.9.1 - verified in the shipped artifact mlflow-2.9.1.post8+tuxcare pulled from Nexus, not only in the branch. Control on shipped 2.22.4.post7 finds the function twice and the LOCAL branch once, so the check detects the code where it exists. 2.9.1's container installs a hardcoded server dependency list (gunicorn[gevent], mlserver pins) rather than model-supplied metadata. The GitHub range '< 3.8.1' is over-broad; the advisory prose scopes the defect to 3.8.0. Separately noted for its own assessment: 2.9.1 does interpolate model-derived values into bash -c elsewhere in _install_pyfunc_deps (the conda env filename and the virtualenv activate command) - a different code path, not this CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15381 does not affect version 2.9.1.post6+tuxcare of mlflow. not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15381" }, "impact_statement": "not_affected \u2014 MLflow version 2.9.1 does not contain tracing and assessment features. These features appear to have been introduced in a later version of mlflow. The vulnerability pattern described in CVE-2025-15381 (missing permission validators on tracing and assessment endpoints when basic-auth is enabled) cannot exist in a version that does not have these endpoints." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-52967 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-52967" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.9.1.post6+tuxcare of mlflow. already_fixed \u2014 target already contains the fix / no backport applicable", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "already_fixed \u2014 target already contains the fix / no backport applicable" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.9.1.post6+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-29T21:50:00.533097+00:00", "status_notes": "Vulnerability CVE-2026-116691 does not affect version 2.9.1.post6+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-116691" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-116691. The vulnerability exists in the mlflow.crewai module, which was introduced in MLflow v2.19.0 (December 2024), approximately one year after v2.9.1 was released (December 2023). The vulnerable code paths (_get_agent_attributes, _construct_full_inputs in mlflow/crewai/autolog.py) do not exist in this version. Git ancestry verification confirms that ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.9.1.post6+tuxcare of mlflow. code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "code_not_present \u2014 the webhook feature does not exist on mlflow 2.9.1. Upstream 64aa0ab7 fixes SSRF in mlflow/webhooks/delivery.py by adding MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS and an ipaddress/socket check. On tuxcare-current/2.9.1 there is no mlflow/webhooks/ package (0 tree entries), 0 occurrences of MLFLOW_WEBHOOK and no validate_webhook_url definition, so the vulnerable code is absent and nothing can be reached. The auto-generated backport MR !55 carried only tests (tests/utils/test_validation.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 does not affect version 2.9.1.post6+tuxcare of mlflow. Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2614" }, "impact_statement": "Version 2.9.1 is not vulnerable. Summary: The target repository (MLflow v2.9.1.post4+tuxcare) does not contain the vulnerable code pattern described in CVE-2026-2614. The vulnerability was introduced in version 3.5.0 (September 2025) when prompt registry support was added to webhooks. The target version predates the introduction of the vulnerable feature by approximately 21 months." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.9.1.post6+tuxcare of mlflow. code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "code_not_present \u2014 the FastAPI/Starlette authentication path does not exist on mlflow 2.9.1. Upstream bb62e773 adds _authenticate_fastapi_request, _get_require_authentication_validator and StarletteRequest handling to mlflow/server/auth/__init__.py. On tuxcare-current/2.9.1 that file contains 0 occurrences of StarletteRequest or fastapi and _authenticate_fastapi_request is defined nowhere in the tree; auth is dispatched Flask-only via BEFORE_REQUEST_VALIDATORS / app.before_request. The vulnerable code is absent. The auto-generated backport MR !57 carried only tests (tests/server/auth/test_auth.py) and no production change; it was rejected and closed. Verified against the branch on 2026-09-03." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-08T09:28:00.123686+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.9.1.post6+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-3198. The vulnerability describes missing authorization checks for Gateway API list endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in MLflow 3.9.0's basic-auth integrated server. Version 2.9.1 has a fundamentally different architecture: the Gateway runs as a separate FastAPI application with no integration to the Fl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 affects version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-33865" }, "action_statement": "Vulnerability CVE-2026-33865 affects version 2.9.1.post6+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.9.1.post6+tuxcare of mlflow. Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Not applicable to 2.9.1: the vulnerable endpoint does not exist on this branch. CVE-2026-33866 is an authorization bypass on GET /ajax-api/2.0/mlflow/logged-models//artifacts/files, fixed upstream by PR #21708 by registering that route in LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS with validate_can_read_logged_model. tuxcare-current/2.9.1 has no LoggedModel API at all: grep over mlflow/**/*.py returns 0 hits for each of 'logged-models', 'LOGGED_MODEL_BEFORE_REQUEST_VALIDATORS', 'validate_can_read_logged_model' and 'artifacts/files', against 3 hits for the validator dict on upstream master (same grep, so the search is sound). The GHSA range 'introduced: 0 / fixed: 3.11.0rc0' is a blanket range, not a code-level assessment." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-23T21:50:24.223294+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.9.1.post6+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1.post13+tuxcare is not affected by CVE-2026-53995. The vulnerability concerns the MLflow Tracing feature, specifically the FileStore.start_trace() method and /api/3.0/mlflow/traces endpoint, which do not exist in version 2.9.1. The tracing feature was introduced in a later version of MLflow (likely the 3.x series when /api/3.0/ endpoints were added). Version 2.9.1 only supports /api..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.9.1.post6+tuxcare of mlflow. not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow 2.9.1 is not affected by CVE-2026-64849 because the webhook feature does not exist in this version. The vulnerability concerns unauthenticated SSRF via the webhook test endpoint (`POST /api/2.0/mlflow/webhooks/{id}/test`) which bypasses SSRF guards through redirect following. Webhooks were introduced in MLflow 3.3.0, significantly later than the target version 2.9.1.post4+tuxcare. Exhaus..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.9.1.post6+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.9.1.post6+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.9.1.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.9.1.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.9.1.post6+tuxcare of mlflow, and is fixed in 2.9.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.9.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:08:19.760702+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2021-45452. All four security defenses from the December 2021 upstream fix are present in the target: (1) post-save validation via validate_file_name(), (2) backslash normalization in get_available_name(), (3) backslash normalization in generate_filename(), and (4) os.path.relpath() in FileSystemStorage._save() ensuring paths remain relative to storage root. ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2022-22818 (XSS via {% debug %} template tag). The upstream fix from commit 394517f078 (2022-01-02) is present in the target. The DebugNode.render() method at django/template/defaulttags.py:120-130 includes all three defensive measures: (1) early return when settings.DEBUG is False (line 122-123), (2) HTML-escaping context values via escape(pformat(val)) (lin..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.9.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-27351 because it uses a completely different architecture (HTMLParser-based) introduced in upstream commit 6ee37ada32 (January 2023). The vulnerable regex pattern `<[^>]+?>|([^<>\\s]+)` that causes catastrophic backtracking is not present in the codebase. The Truncator.words(html=True) method uses TruncateWordsHTMLParser which leverages Python's standard ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.9.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 is not present in Django 5.1.9. The upstream fix (commit f5d16483f3) was already included in the Django 5.1.x release branch before TuxCare onboarded this version. The fix standardizes timing in verify_password() by executing password hashing operations even for unusable passwords, preventing user enumeration via timing attacks. The vulnerable pattern (immediate return without ha..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:47:00.156499+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is not affected by CVE-2024-39330. The vulnerability pattern (directory traversal via Storage.save() when subclasses override generate_filename() without validation) is not present in this version. The fix was already included in the upstream Django 5.1.x release before TuxCare's maintenance began. Commit 6d36203648a by upstream Django developer Natalia (124304+nessita@users.norepl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.9.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9 is not affected by CVE-2024-45231. The vulnerability (user email enumeration via unhandled exceptions during password reset) was fixed in upstream Django 5.1.1, and the target version 5.1.9 inherited this fix from upstream. The defense code (try-except block catching exceptions in PasswordResetForm.send_mail) is present at django/contrib/auth/forms.py lines 430-435. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.9.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:31:17.645830+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 The target Django 5.1.9.post9+tuxcare contains the complete fix for CVE-2024-56374. The upstream fix (commit 4806731e58 by mike@manfre.net) was already included in the Django 5.1.9 release before TuxCare began maintaining this version. The fix adds length validation (MAX_IPV6_ADDRESS_LENGTH=39) to IPv6 validation functions via _ipv6_address_from_str(), preventing DoS attacks via excessively lon..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:05:00.123888+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 Target Django 5.1.9 is not affected by CVE-2025-26699. The vulnerability existed in the custom string-wrapping implementation that used an inefficient _generator() function, which could cause DoS with very long strings. However, this vulnerable code pattern is not present in the target. The fix (commit 8dbb44d3) replacing the custom implementation with Python's optimized textwrap.TextWrapper wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:21:54.458679+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 Django 5.1.9 is NOT AFFECTED by CVE-2025-27556. The vulnerability, a DoS attack via slow Unicode normalization in URL processing, was fixed in the upstream Django 5.1.9 release before TuxCare onboarded this version. The fix (commit edc2716d01a) adds a MAX_URL_LENGTH check (2048 bytes) to reject excessively long URLs before they reach the expensive urlparse/normalization operations. This fix was..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.9.post7+tuxcare of django. not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.9.post9+tuxcare is not affected by CVE-2025-32873. The upstream fix for the DoS vulnerability in strip_tags() was already present in Django 5.1.9 (released April 8, 2025) which TuxCare onboarded. The fix adds pre-validation checks to detect and reject inputs with large sequences of incomplete HTML tags before the expensive stripping operation, raising SuspiciousOperation when malicio..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.9.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.9.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.9.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.9.post7+tuxcare" } } ], "timestamp": "2026-10-01T06:25:00.256695+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.9.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before version 9.0.0. The target repository is at version 11.2.1.post14+tuxcare and contains the complete upstream fix that was merged on January 1, 2022 (commit 5543e4e2d). The fix predates all TuxCare work on this branch by 6989 commits, meaning it shipped in the upstream release. The vulnerable code pattern is not present in the target." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 (buffer over-read in path_getbbox) is NOT present in Pillow 11.2.1. Both upstream fixes were applied by Andrew Murray (radarhere@users.noreply.github.com) on December 6, 2021, and shipped in Pillow 9.0.0 (January 2022). The target version 11.2.1 inherits these fixes from the upstream release. The vulnerable pattern (uninitialized memory access when path count is 0 or 1) has been ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:06:57.987022+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow vulnerability in _imagingcms.c where strcpy was used to copy mode strings into fixed 8-byte buffers (mode_in, mode_out) in the CmsTransformObject structure. The target version 11.2.1 is not affected because the vulnerable code pattern has been completely eliminated by upstream refactoring. The original strcpy->strncpy fix (commit 2a93aba5c, Feb 2024) w..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2025-48379 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:18:45.160348+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.2.1.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:59:00.157268+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:48:41.625360+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T11:27:40.605353+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-42309 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42309" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-21T10:57:00.118777+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 11.2.1.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-23T10:43:00.099314+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.2.1.post9+tuxcare of pillow, and is fixed in 11.2.1.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target repository (Pillow 11.2.1.post14+tuxcare) is NOT AFFECTED by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF marker to truncated JPEG files) was fixed in upstream commit 1059eb5376 by Andrew Murray on 2022-01-01. This fix was already included in the upstream Pillow 11.2.1 release before TuxCare onboarded it in September 2025. The vulnerable code pattern (miss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.2.1.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.2.1.post9+tuxcare" } } ], "timestamp": "2026-10-22T20:13:00.245772+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.2.1.post9+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-78g4-xqwv-q3g8 is a heap-buffer-overflow in OpenJPEG library versions 2.5.3 and 2.5.4. While Pillow 11.2.1 configures OpenJPEG 2.5.3 as a build dependency, the vulnerable source code (src/lib/openjp2/j2k.c from OpenJPEG) is not present in the Pillow source repository. OpenJPEG is downloaded from github.com/uclouvain/openjpeg during the build process. The Pillow repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 65.5.1.post2+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 affects setuptools \u226465.5.0 due to a ReDoS vulnerability in the REL regex pattern in package_index.py. The target version 65.5.1 contains the upstream fix (commit 43a9c9bfa) that limits whitespace matching to prevent catastrophic backtracking. This fix was authored by Jason R. Coombs (jaraco@jaraco.com) and shipped in the upstream 65.5.1 release, which TuxCare subsequently onboard...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 affects setuptools \u226465.5.0 due to a ReDoS vulnerability in the REL regex pattern in package_index.py. The target version 65.5.1 contains the upstream fix (commit 43a9c9bfa) that limits whitespace matching to prevent catastrophic backtracking. This fix was authored by Jason R. Coombs (jaraco@jaraco.com) and shipped in the upstream 65.5.1 release, which TuxCare subsequently onboard..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 65.5.1.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 65.5.1.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 65.5.1.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@65.5.1.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@65.5.1.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 65.5.1.post2+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 65.5.1.post2+tuxcare of setuptools." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:34:00.198709+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow versions before 9.0.0 due to improper initialization in path_getbbox(). The target version 9.4.0 contains both upstream fixes: (1) calloc-based zero-initialization of coordinate arrays (line 60 of src/path.c), and (2) explicit bounds checking when count==0 (lines 312-315). Both fixes were authored by upstream developer Andrew Murray and shipped in the Pillow 9.0.0 ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:37:00.106679+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is not present in the target. The vulnerability affects Pillow before 9.0.0, causing a buffer over-read in path_getbbox when handling paths with count < 2. The target is Pillow 9.4.0.post14+tuxcare, which inherited the upstream fixes from Pillow 9.0.1 (released December 2021). Both required fixes are present: (1) calloc initialization of coordinate arrays (commit 1e092419b), and ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:04:46.940797+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is NOT affected by CVE-2026-112396. The target has a fundamentally different architecture than the vulnerable versions: it lacks the ImagingLibTiffEncodeCleanup function and does not register any cleanup callback. Error paths in 9.4.0 call TIFFClose() BEFORE freeing the buffer (lines 971-973, 988-990), preventing the use-after-free. The vulnerability requires a cleanup function to ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:11.211187+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112891 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112891" }, "impact_statement": "not_affected \u2014 CVE-2026-112891 describes CPU exhaustion via repeated comment processing in GIF save operations. Analysis confirms Pillow 9.4.0 contains the fix (commit 62d0f0e38, May 2022) that consolidates comment block handling in _get_global_header(), preventing O(N*chunks) overhead when processing large comments. This fix was authored by upstream Pillow developer Andrew Murray and shipped in Pillow 9.2.0,..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-24T04:15:01.216829+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-114501. The vulnerability concerns Arrow export functionality (__arrow_c_array__, __arrow_c_schema__, fromarrow) that leaks uninitialized heap memory when PILLOW_ALIGNMENT is set above 1. This entire Arrow export feature does not exist in version 9.4.0 - no Arrow.c implementation, no Arrow export methods in Image.py, and no related test files. The vulner..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:30:06.288541+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Pillow 9.4.0 is not affected by CVE-2026-42309. The vulnerability requires recursive list unpacking logic that was introduced in Pillow 11.2.1. Version 9.4.0 uses a macro-based coordinate parser (src/path.c lines 165-182) that rejects nested lists with ValueError before any recursive processing, preventing the heap buffer overflow. The CVE explicitly states the vulnerability was \"introduced in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T07:06:12.222328+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:48:00.091308+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T07:25:47.461321+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:57:08.208128+00:00", "status_notes": "Vulnerability CVE-2026-96644 does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-96644" }, "impact_statement": "not_affected \u2014 CVE-2026-96644 describes a heap over-read vulnerability in Pillow's Windows-only EMF/WMF handler where dimensions are read as 32-bit values but truncate to 16-bit for allocation while the copy uses full 32-bit values. The vulnerable code exists in the source repository (src/display.c:779-878, PyImaging_DrawWmf function within #ifdef _WIN32 block). However, TuxCare builds are Linux-only (tuxcare..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T11:30:22.445084+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.4.0.post6+tuxcare of pillow, and is fixed in 9.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.4.0.post6+tuxcare of pillow. not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.4.0.post14+tuxcare is not affected by GHSA-4fx9-vc88-q2xc. The vulnerability (infinite loop when appending EOF markers to truncated JPEG files) was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on Jan 1, 2022. This fix was included in the upstream Pillow 9.4.0 release, which TuxCare subsequently onboarded. The vulnerable code pattern is n..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is fixed in version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.4.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.4.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.4.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-101917" }, "action_statement": "Vulnerability CVE-2026-101917 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102267" }, "action_statement": "Vulnerability CVE-2026-102267 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.8.0.post3+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post3+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post3+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post3+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 68.0.0.post2+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 is not present in setuptools 68.0.0. The vulnerable regex pattern causing catastrophic backtracking DoS has been replaced with the fixed version. The fix (limiting whitespace matching from \\s* to \\s{0,10}) was introduced in upstream commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be by Jason R. Coombs and was already present in upstream release 65.5.1, which predates the target vers...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 is not present in setuptools 68.0.0. The vulnerable regex pattern causing catastrophic backtracking DoS has been replaced with the fixed version. The fix (limiting whitespace matching from \\s* to \\s{0,10}) was introduced in upstream commit 43a9c9bfa6aa626ec2a22540bea28d2ca77964be by Jason R. Coombs and was already present in upstream release 65.5.1, which predates the target vers..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2024-6345 is fixed in version 68.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 68.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 68.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@68.0.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@68.0.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T21:50:56.656209+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 68.0.0.post2+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 68.0.0.post2+tuxcare of setuptools." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post13+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post13+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post13+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post13+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post13+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post13+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post13+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post13+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post13+tuxcare" } } ], "timestamp": "2026-10-08T10:16:00.096517+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post13+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post19+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post19+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post19+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post19+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post19+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post19+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post19+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post19+tuxcare" } } ], "timestamp": "2026-10-08T10:45:15.929681+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post19+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post5+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post5+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post5+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post5+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post1+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post1+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post1+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post1+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post1+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post1+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post1+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post1+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post17+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post17+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post17+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post17+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post17+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post8+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post8+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post8+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post8+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post8+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post8+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2024-1681 does not affect version 4.0.2.post3+tuxcare of flask-cors. not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-1681" }, "impact_statement": "not_affected \u2014 CVE-2024-1681 log injection vulnerability is NOT present in flask-cors 4.0.2. The vulnerable pattern (logging request.path with %s format allowing CRLF injection) was fixed in upstream commit 6172c20 by changing the format specifier from %s to %r, which applies repr() to escape control characters. This fix was authored by Anes Hujevi\u0107 (upstream contributor) and shipped in upstream release 4.0.0..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6221 affects version 4.0.2.post3+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6221" }, "action_statement": "Vulnerability CVE-2024-6221 affects version 4.0.2.post3+tuxcare of flask-cors." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6839 is fixed in version 4.0.2.post3+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6844 is fixed in version 4.0.2.post3+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6844" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/flask-cors@4.0.2.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-6866 is fixed in version 4.0.2.post3+tuxcare of flask-cors.", "vulnerability": { "name": "CVE-2024-6866" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post10+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post10+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post10+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15381" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post10+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post10+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post10+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post10+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post10+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post10+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post10+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post10+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post10+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2026-8147 is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post10+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm is fixed in version 2.22.4.post10+tuxcare of mlflow.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post12+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post12+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post12+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post12+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post12+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post12+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post12+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post12+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.1.post12+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post2+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 1.26.4.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-50181" }, "action_statement": "Vulnerability CVE-2025-50181 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post2+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post2+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.4.post2+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post14+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post14+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post14+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post14+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post14+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post14+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.8.0.post4+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.8.0.post4+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-102271 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post4+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.8.0.post4+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.8.0.post4+tuxcare of pyjwt, and is fixed in 2.8.0.post5+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post4+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post4+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post4+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post4+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post4+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:25:19.223832+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:56:00.100136+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.8.post3+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post3+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" }, "action_statement": "Vulnerability GHSA-537c-gmf6-5ccf affects version 42.0.8.post3+tuxcare of cryptography, and is fixed in 42.0.8.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:35:47.119139+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 is fixed in version 42.0.8.post3+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42...", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:30:57.264034+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.8.post3+tuxcare of cryptography. not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.8.0.post1+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 is a ReDoS (Regular Expression Denial of Service) vulnerability in setuptools' package_index.py REL regex that allows attackers to cause CPU exhaustion via HTML with excessive whitespace in 'rel=' attributes. The target repository (setuptools 75.8.0.post3+tuxcare) is NOT AFFECTED because the vulnerable regex pattern is not present. The fix limiting whitespace quantifiers from unl..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.8.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.8.0.post1+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.8.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 75.8.0.post1+tuxcare of setuptools, and is fixed in 75.8.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 75.8.0.post1+tuxcare of setuptools, and is fixed in 75.8.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.8.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.8.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.8.0.post1+tuxcare of setuptools, and is fixed in 75.8.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.8.0.post1+tuxcare of setuptools, and is fixed in 75.8.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post8+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post8+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post8+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post8+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post8+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post8+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post8+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post8+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post8+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post8+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 is fixed in version 2.22.4.post8+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-8147" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post8+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-0286 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-0286" }, "action_statement": "Vulnerability CVE-2023-0286 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:08:58.958503+00:00", "status_notes": "Vulnerability CVE-2023-23931 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23931" }, "impact_statement": "not_affected \u2014 CVE-2023-23931 is NOT present in the target. The vulnerability was fixed in upstream pyca/cryptography version 39.0.1 (released 2023-02-07) by adding `require_writable=True` to the `from_buffer()` call in `Cipher.update_into()`. The target is running version 42.0.8.post4+tuxcare, which already includes this upstream fix. The vulnerable code pattern (accepting immutable buffers that can be mutat..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2023-38325 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-38325" }, "action_statement": "Vulnerability CVE-2023-38325 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:25:19.223832+00:00", "status_notes": "Vulnerability CVE-2023-49083 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-49083" }, "impact_statement": "not_affected \u2014 CVE-2023-49083 affects the Python/C-FFI backend implementation of PKCS7 certificate loading, which performed a NULL pointer dereference when processing malformed PKCS7 blobs. Version 42.0.8 is NOT AFFECTED because the vulnerable Python backend code was completely removed in upstream commit 41daf2d8 (January 2024) and replaced with a safe Rust implementation using Option types and pattern matchi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:54:35.688212+00:00", "status_notes": "Vulnerability CVE-2023-50782 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2023-50782" }, "action_statement": "Vulnerability CVE-2023-50782 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:19:27.667174+00:00", "status_notes": "Vulnerability CVE-2024-0727 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe...", "vulnerability": { "name": "CVE-2024-0727" }, "impact_statement": "not_affected \u2014 CVE-2024-0727 is an OpenSSL vulnerability (NULL pointer dereference in PKCS12 functions), not a flaw in the cryptography library's own code. The target repository contains only FFI bindings and Python wrappers that call OpenSSL functions\u2014no OpenSSL C source code is present. Verdict: not_affected with justification requires_dependency because the vulnerable code exists solely in the OpenSSL depe..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2024-12797 is fixed in version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-12797" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:00:55.169132+00:00", "status_notes": "Vulnerability CVE-2024-26130 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2024-26130" }, "action_statement": "Vulnerability CVE-2024-26130 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-26007 is fixed in version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-26007" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-34073 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-34073" }, "action_statement": "Vulnerability CVE-2026-34073 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:56:00.100136+00:00", "status_notes": "Vulnerability CVE-2026-39892 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39892" }, "impact_statement": "not_affected \u2014 Version 42.0.8 is not affected by CVE-2026-39892. The vulnerability exists only in the PyBuffer API implementation (for Python 3.11+) which was introduced in commit 6801b2eb (May 2025), after version 42.0.8 was released. Version 42.0.8 uses the older CFFI-based buffer handling path that does not have this vulnerability. The upstream fix (commit c09d38ae/622d672e) and TuxCare backport (commit 0a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-69247 affects version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69247" }, "action_statement": "Vulnerability CVE-2026-69247 affects version 42.0.8.post4+tuxcare of cryptography." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69248 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-69248" }, "impact_statement": "not_affected \u2014 Target version 42.0.8.post2+tuxcare is NOT affected by CVE-2026-69248. The vulnerability requires wildcard DNS SAN support in name constraint validation, which was introduced in upstream commit 286c89128 (Jan 7, 2025) and fixed in commit 91d728897 (Mar 25, 2026, also known as CVE-2026-34073). The 42.x branch never received the vulnerable wildcard support code. Instead, this version uses the old..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-69249 is fixed in version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "CVE-2026-69249" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability GHSA-537c-gmf6-5ccf is fixed in version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-537c-gmf6-5ccf" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:35:47.119139+00:00", "status_notes": "Vulnerability GHSA-5cpq-8wj7-hf2v does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-5cpq-8wj7-hf2v" }, "impact_statement": "not_affected \u2014 Target version 42.0.8 is NOT affected by GHSA-5cpq-8wj7-hf2v. This CVE affects cryptography versions 0.5-40.0.2 due to vulnerable OpenSSL versions (1.1.1t, 3.0.8, 3.1.0) bundled in pre-built wheels. The vulnerability was fixed in version 41.0.0+ by updating to patched OpenSSL versions (1.1.1u, 3.0.9, 3.1.1). Target version 42.0.8 bundles even newer OpenSSL versions (1.1.1w, 3.0.13, 3.1.5, 3.2.1..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-h4gh-qq45-vh27 is fixed in version 42.0.8.post4+tuxcare of cryptography.", "vulnerability": { "name": "GHSA-h4gh-qq45-vh27" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:04:48.394138+00:00", "status_notes": "Vulnerability GHSA-jm77-qphf-c4w8 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42...", "vulnerability": { "name": "GHSA-jm77-qphf-c4w8" }, "impact_statement": "not_affected \u2014 The target repository (cryptography 42.0.8.post4+tuxcare) is not affected by GHSA-jm77-qphf-c4w8. This CVE concerns vulnerable OpenSSL versions bundled in cryptography wheel artifacts, not the cryptography source code itself. The vulnerability affected versions 0.8-41.0.2 which bundled OpenSSL with July 2023 security issues. The fix (version 41.0.3) bundled OpenSSL 3.1.2. The target version (42..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/cryptography@42.0.8.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/cryptography@42.0.8.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:30:57.264034+00:00", "status_notes": "Vulnerability GHSA-v8gr-m533-ghj9 does not affect version 42.0.8.post4+tuxcare of cryptography. not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix...", "vulnerability": { "name": "GHSA-v8gr-m533-ghj9" }, "impact_statement": "not_affected \u2014 GHSA-v8gr-m533-ghj9 affects cryptography versions 2.5-41.0.3 due to vulnerable OpenSSL bundled in pre-built binary wheels. The target version (42.0.8.post4+tuxcare) is based on upstream 42.0.0, which updated to OpenSSL 3.2.0\u2014well beyond the vulnerable versions and the 3.1.3 used in the 41.0.4 fix. The vulnerability is in the bundled OpenSSL dependency, not in cryptography's source code. The fix..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-22815 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22815" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-22816 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22816" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post11+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post11+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post11+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post11+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post11+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post11+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post11+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc is fixed in version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post11+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post11+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post11+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post7+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14287" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-15031" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post7+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post7+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post7+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-0596" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post7+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2033" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post7+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2635" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-2651" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post7+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post7+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post7+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4035" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 is fixed in version 2.22.4.post7+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-4137" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post7+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post7+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post10+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post10+tuxcare" } } ], "timestamp": "2026-10-09T09:23:00.161482+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:12:00.150579+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.15.4.post4+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is NOT present in NumPy 1.15.4. The vulnerability involved insecure use of tempfile.mktemp() in numpy/f2py/__init__.py and numpy/f2py/f2py2e.py, which allowed local users to conduct symlink attacks on predictable temporary filenames. The fix (commit 0bb46c1448) replaced mktemp() with secure alternatives: NamedTemporaryFile() and mkdtemp() which atomically create files/directories...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:24:00.191135+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.15.4.post4+tuxcare of numpy. not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us...", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 NumPy 1.15.4 is not affected by CVE-2014-1859. The original vulnerability (insecure mktemp usage allowing symlink attacks) was fixed by upstream in February 2014 before the 1.8.1 release. Production f2py code uses secure methods (NamedTemporaryFile/mkdtemp). Test code uses mktemp within mkdtemp()-created directories with 0o700 permissions, providing runtime protection against the CVE's cross-us..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.15.4.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.15.4.post4+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2019-6446 is fixed in version 1.15.4.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33430 is fixed in version 1.15.4.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-33430" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.15.4.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-41495 is fixed in version 1.15.4.post4+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.15.4.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.15.4.post4+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.15.4.post4+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.15.4.post4+tuxcare of numpy, and is fixed in 1.15.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post8+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post8+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post8+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post8+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post8+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post8+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post8+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post10+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post10+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post10+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post10+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post10+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 3.2.25.post10+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:05:08.405699+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.post5+tuxcare of django. not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 affects Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The target repository is Django 5.1.post14+tuxcare, which includes the upstream fix from commit 6d343d01c5 (Dec 2021) by Florian Apolloner. All required defenses are present: backslash normalization, path traversal detection for \"..\" sequences, validate_file_name() calls throughout the save path, and os.pa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:53:47.658121+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.post5+tuxcare of django. not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.1.post14+tuxcare repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed in upstream Django commit 394517f078 on January 2, 2022, over 3 years before TuxCare began maintaining this version. The fix is present in the current code: django/template/defaulttags.py lines 120-131 show the DebugNode.render..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-41323 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:15:06.276027+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.post5+tuxcare of django. not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.0.post14+tuxcare is NOT affected by CVE-2024-27351. The target uses an HTMLParser-based architecture (introduced upstream in commit 6ee37ada32 on 2023-01-03) that completely replaced the vulnerable regex-based HTML truncation. The vulnerable regex pattern r\"<[^>]+?>|([^<>\\s]+)\" that causes ReDoS on inputs like \"<<<...\" is absent from this version. CVE-2024-27351 only affects Django 3..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:11:13.694200+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.post5+tuxcare of django. not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 affects Django's ModelBackend.authenticate() method, allowing user enumeration via timing attacks on users with unusable passwords. The target repository (Django 5.1.post14+tuxcare) is NOT AFFECTED because the upstream fix (commit f5d16483f3) was already present in Django 5.1 release before TuxCare's onboarding. The fix adds a computationally expensive make_password() call when c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:44:00.091011+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.post5+tuxcare of django. not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 directory traversal vulnerability is NOT present in Django 5.1 at commit 8ba232230f. The fix was already included in the upstream Django 5.1.x release that TuxCare started from. The upstream commit 6d36203648 (authored by Natalia from Django core team) added three validation points in Storage.save() and backslash normalization in validate_file_name(), all of which are present in ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.post5+tuxcare of django, and is fixed in 5.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post4+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post4+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post4+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post4+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post4+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post4+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post5+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post5+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post5+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post5+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post5+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post5+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11392 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11392" }, "action_statement": "Vulnerability CVE-2024-11392 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11393 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11393" }, "action_statement": "Vulnerability CVE-2024-11393 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-11394 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-11394" }, "action_statement": "Vulnerability CVE-2024-11394 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2024-12720 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2024-12720" }, "action_statement": "Vulnerability CVE-2024-12720 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-1194 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1194" }, "impact_statement": "not_affected \u2014 CVE-2025-1194 (ReDoS in GPT-NeoX-Japanese tokenizer) is NOT present in this target. The vulnerable regex pattern in `content_repatter6` has been replaced with safe alternatives using possessive quantifiers (Python 3.11+) or simplified patterns (Python <3.11) that prevent catastrophic backtracking. The fix was authored by upstream developer Matt (Rocketknight1@users.noreply.github.com) in commit..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-2099 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-2099" }, "action_statement": "Vulnerability CVE-2025-2099 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:56:36.802731+00:00", "status_notes": "Vulnerability CVE-2025-3263 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3263" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6) is NOT AFFECTED by CVE-2025-3263. The vulnerable regex pattern `config\\.(.*)\\.json` that causes ReDoS through catastrophic backtracking is not present in the target code. The fix (commit 126abe3461) replaced regex matching with simple string prefix/suffix checks (`startswith(\"config.\")` and `endswith(\".json\")`), eliminating the O(2^n) backtracking vul..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:52:52.459677+00:00", "status_notes": "Vulnerability CVE-2025-3264 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3264" }, "impact_statement": "not_affected \u2014 The target repository (transformers 4.57.6.post5+tuxcare) is NOT affected by CVE-2025-3264. The ReDoS vulnerability in the get_imports() function was fixed in upstream commit 126abe3461 (\"More ReDOS fixes!\") which replaced the vulnerable regex pattern `\\s*try\\s*:.*?except.*?:` with AST-based parsing. This fix was already present in upstream release 4.57.6 before TuxCare onboarded it (commit ba2..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3777 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3777" }, "impact_statement": "not_affected \u2014 CVE-2025-3777 is not present in the target. The vulnerability involved insecure URL validation using `startswith()` for YouTube URLs, which could be bypassed via URL username injection (e.g., `https://www.youtube.com@evil.com`). The fix was applied by Hugging Face upstream in commit 4f96081aad on April 17, 2025, replacing the vulnerable `video.startswith(\"https://www.youtube.com\")` check with s..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:56:00.183573+00:00", "status_notes": "Vulnerability CVE-2025-3933 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-3933" }, "impact_statement": "not_affected \u2014 CVE-2025-3933 ReDoS vulnerability is NOT present in target version 4.57.6.post5+tuxcare. The vulnerable regex pattern `` in DonutProcessor.token2json() has been replaced with a safe two-step manual parsing approach. This fix was authored by the upstream HuggingFace team (commit ebbe9b12dd by Matt/Rocketknight1) and was already present in upstream version 4.57.6 when TuxCare onboarded i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:57:53.604864+00:00", "status_notes": "Vulnerability CVE-2025-5197 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-5197" }, "impact_statement": "not_affected \u2014 The target (transformers 4.57.6.post5+tuxcare) is not affected by CVE-2025-5197. The ReDoS vulnerability in convert_tf_weight_name_to_pt_weight_name() was fixed by upstream commit 701caef704 (authored by Matt/Rocketknight1), which added input validation at lines 81-83 to reject strings that could trigger catastrophic backtracking. This fix was already present in upstream release 4.57.6 when Tux..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:59:00.126054+00:00", "status_notes": "Vulnerability CVE-2025-6051 does not affect version 4.57.6.post3+tuxcare of transformers. not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-6051" }, "impact_statement": "not_affected \u2014 CVE-2025-6051: ReDoS vulnerability in EnglishNormalizer.normalize_numbers() was fixed in upstream commit 54a02160eb by Matt (Rocketknight1@users.noreply.github.com) and shipped in transformers 4.57.6. The target repository at version 4.57.6 already contains this upstream fix - the vulnerable non-atomic regex quantifiers have been replaced with atomic grouping patterns ([0-9]++ instead of [0-9]+..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6638 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6638" }, "action_statement": "Vulnerability CVE-2025-6638 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:27:33.941409+00:00", "status_notes": "Vulnerability CVE-2025-6921 affects version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2025-6921" }, "action_statement": "Vulnerability CVE-2025-6921 affects version 4.57.6.post3+tuxcare of transformers." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1839 is fixed in version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-1839" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4372 is fixed in version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-4372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-5241 is fixed in version 4.57.6.post3+tuxcare of transformers.", "vulnerability": { "name": "CVE-2026-5241" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:07:00.151595+00:00", "status_notes": "Vulnerability CVE-2026-80047 affects version 4.57.6.post3+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-80047" }, "action_statement": "Vulnerability CVE-2026-80047 affects version 4.57.6.post3+tuxcare of transformers, and is fixed in 4.57.6.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/transformers@4.57.6.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/transformers@4.57.6.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-9856 affects version 4.57.6.post3+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-9856" }, "action_statement": "Vulnerability CVE-2026-9856 affects version 4.57.6.post3+tuxcare of transformers, and is fixed in 4.57.6.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102271 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102274 affects version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" }, "action_statement": "Vulnerability CVE-2026-102274 affects version 2.8.0.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102275" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:36:00.107520+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.8.0.post5+tuxcare of pyjwt. not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 The target PyJWT version 2.8.0.post5+tuxcare is not affected by CVE-2026-103001. The vulnerability (caller-supplied options dict mutation causing claim verification bypass when dict is reused across decode operations) was fixed in upstream commit 3d4d822 (2022-04-05) by Aarni Koskela. This fix was already present in the upstream PyJWT 2.8.0 release that TuxCare onboarded. The CVE describes a re..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.8.0.post5+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522: PyJWKClient URI scheme SSRF vulnerability is already fixed in the target repository. The fix was introduced via commit 67029b7 (Backport CVE-2026-48526 to 2.8.0) on 2026-07-13, which added URI scheme validation to reject non-HTTP(S) schemes (file://, ftp://, data:, etc.) before any fetch operation. While the version number was later reverted from 2.8.0.post2+tuxcare to 2.8.0.pos..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T16:54:49.980091+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 2.8.0.post5+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0 is not affected by CVE-2026-48523. The vulnerability (algorithm allow-list bypass when decoding JWTs with PyJWK keys) was introduced in commit ab8176abe21e550dbc1c9a6bb7e78ad80853bfb1 (\"Decode with PyJWK #886\") in May 2024, first released in version 2.9.0. Version 2.8.0 predates this feature entirely. While PyJWK exists as a class in 2.8.0, it cannot be used with jwt.decode() becaus..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48525 does not affect version 2.8.0.post5+tuxcare of pyjwt. pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48525" }, "impact_statement": "pyjwt 2.8.0 is not affected by CVE-2026-48525. The upstream fix (jpadilla/pyjwt@95791b1) forwards the opt-in 'enforce_minimum_key_length' option into sig_options in api_jwt.py; the vulnerability is that setting that option per call had no effect, letting an undersized RSA key through. Branch tuxcare-current/2.8.0 contains none of that machinery (no enforce_minimum_key_length, no sig_options, no InsecureKeyLengthWarning in jwt/). The CVE-2025-45768 backport (796cc35, PYELSCVE-180) instead enforces a minimum 2048-bit RSA key unconditionally in RSAAlgorithm.prepare_key, which no option can disable. Verified on the released 2.8.0.post3+tuxcare wheel from Nexus with a fresh 1024-bit RSA key: rejected with no options, with enforce_minimum_key_length=False and with verify_signature=False; a 2048-bit key still round-trips. MR !18 was changelog-only and has been closed. Jira PYELSCVE-1216." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.8.0.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.8.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:24:00.162980+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 2.8.0.post5+tuxcare of pyjwt. not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou...", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 2.8.0.post5+tuxcare contains the vulnerable code pattern (HMACAlgorithm.from_jwk accepts empty k and returns b'' without validation at jwt/algorithms.py:365), but the library's documented verification paths are protected by a runtime defense. The prepare_key method (lines 285-326) validates and rejects empty HMAC keys before any cryptographic operations. All library verification flows rou..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22815" }, "action_statement": "Vulnerability CVE-2022-22815 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22816" }, "action_statement": "Vulnerability CVE-2022-22816 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post2+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post2+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post2+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "action_statement": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post2+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6709 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6709" }, "action_statement": "Vulnerability CVE-2023-6709 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6753 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6753" }, "action_statement": "Vulnerability CVE-2023-6753 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6831 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6831" }, "action_statement": "Vulnerability CVE-2023-6831 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6909 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6909" }, "action_statement": "Vulnerability CVE-2023-6909 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6940 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6940" }, "action_statement": "Vulnerability CVE-2023-6940 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6974 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6974" }, "action_statement": "Vulnerability CVE-2023-6974 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6975 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6975" }, "action_statement": "Vulnerability CVE-2023-6975 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2023-6976 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6976" }, "action_statement": "Vulnerability CVE-2023-6976 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2023-6977 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2023-6977" }, "action_statement": "Vulnerability CVE-2023-6977 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1483 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1483" }, "action_statement": "Vulnerability CVE-2024-1483 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1558 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1558" }, "action_statement": "Vulnerability CVE-2024-1558 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1560 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1560" }, "action_statement": "Vulnerability CVE-2024-1560 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1593 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1593" }, "action_statement": "Vulnerability CVE-2024-1593 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-1594 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-1594" }, "action_statement": "Vulnerability CVE-2024-1594 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27132 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27132" }, "action_statement": "Vulnerability CVE-2024-27132 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27133 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27133" }, "action_statement": "Vulnerability CVE-2024-27133 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-27134 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-27134" }, "action_statement": "Vulnerability CVE-2024-27134 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-2928 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-2928" }, "action_statement": "Vulnerability CVE-2024-2928 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:04:41.652542+00:00", "status_notes": "Vulnerability CVE-2024-3099 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-3099" }, "impact_statement": "not_affected \u2014 CVE-2024-3099 (URL-encoded model names vulnerability) is NOT present in mlflow 2.22.4 at HEAD (7af4770cd). The upstream fix (commit a924d129e \"Disallow % in model names\", authored by daniel.lok@databricks.com on 2024-03-21) was already included in the upstream release that TuxCare onboarded. The defense code validates model names and rejects any containing '%' character, preventing URL-encoded ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-3573 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-3573" }, "action_statement": "Vulnerability CVE-2024-3573 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37052 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37052" }, "action_statement": "Vulnerability CVE-2024-37052 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37053 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37053" }, "action_statement": "Vulnerability CVE-2024-37053 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37054 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37054" }, "action_statement": "Vulnerability CVE-2024-37054 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-37055 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37055" }, "action_statement": "Vulnerability CVE-2024-37055 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37056 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37056" }, "action_statement": "Vulnerability CVE-2024-37056 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37057 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37057" }, "action_statement": "Vulnerability CVE-2024-37057 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37058 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37058" }, "action_statement": "Vulnerability CVE-2024-37058 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37059 does not affect version 2.22.4.post1+tuxcare of mlflow. already_fixed \u2014 fix already present in target (commit c6c9002f29)", "vulnerability": { "name": "CVE-2024-37059" }, "impact_statement": "already_fixed \u2014 fix already present in target (commit c6c9002f29)" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37060 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37060" }, "action_statement": "Vulnerability CVE-2024-37060 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-37061 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-37061" }, "action_statement": "Vulnerability CVE-2024-37061 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:45:00.224071+00:00", "status_notes": "Vulnerability CVE-2024-4263 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-4263" }, "impact_statement": "not_affected \u2014 CVE-2024-4263 is NOT present in mlflow 2.22.4. The vulnerability allowed users with EDIT permissions to delete artifacts by incorrectly checking `can_update` instead of `can_manage` for DELETE operations. The upstream fix (commit cfa71879a \"Fix #11308\" by harupy) was already included in the mlflow 2.22.4 release that TuxCare onboarded. The target code correctly implements the fix: function `val..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2024-6838 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-6838" }, "action_statement": "Vulnerability CVE-2024-6838 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2024-8859 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2024-8859" }, "action_statement": "Vulnerability CVE-2024-8859 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-0453 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-0453" }, "action_statement": "Vulnerability CVE-2025-0453 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-10279 is fixed in version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-10279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11200 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11200" }, "action_statement": "Vulnerability CVE-2025-11200 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:12:23.322086+00:00", "status_notes": "Vulnerability CVE-2025-11201 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-11201" }, "action_statement": "Vulnerability CVE-2025-11201 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14279 is fixed in version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2025-14279" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14287 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-14287" }, "action_statement": "Vulnerability CVE-2025-14287 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:43:00.148441+00:00", "status_notes": "Vulnerability CVE-2025-1474 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-1474" }, "impact_statement": "not_affected \u2014 CVE-2025-1474 (passwordless user account creation) is NOT present in mlflow 2.22.4. The vulnerability was fixed in upstream commit 1f74f3f24 by WeichenXu@databricks.com, which shipped in v2.22.0rc0 (April 2025) - before the target version 2.22.4. The fix adds `_validate_password` validation in `create_user` method that rejects passwords that are None or shorter than 12 characters. This defense ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15031 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2025-15031" }, "action_statement": "Vulnerability CVE-2025-15031 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15036 does not affect version 2.22.4.post1+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-15036" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post1+tuxcare) is NOT VULNERABLE to CVE-2025-15036. While the vulnerable code pattern (tarfile.extractall in extract_archive_to_dir) exists, the security fix has been backported from upstream v3.9.0. The check_tarfile_security function is properly implemented and called before tar extraction, preventing path traversal attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-15379 does not affect version 2.22.4.post1+tuxcare of mlflow. Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')", "vulnerability": { "name": "CVE-2025-15379" }, "impact_statement": "Patches already applied: a22ce7157f646bdce4c95106fc38ccc9ca289205 (already in target via 3e7233561c 'PYELSCVE-466: Fix for AIKIDO-2025-11008')" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-25T12:45:05.079328+00:00", "status_notes": "Vulnerability CVE-2025-15381 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-15381" }, "action_statement": "Vulnerability CVE-2025-15381 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:48:00.135806+00:00", "status_notes": "Vulnerability CVE-2025-52967 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52967" }, "impact_statement": "not_affected \u2014 The target MLflow 2.22.4 repository is NOT affected by CVE-2025-52967. The vulnerability (lack of gateway_path validation in gateway_proxy_handler) has been fixed by an upstream commit that shipped in MLflow v2.22.1. The fix adds comprehensive format validation via _validate_gateway_path() function (lines 1377-1395) that restricts gateway_path to specific allowed patterns based on HTTP method, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0545 does not affect version 2.22.4.post1+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-0545" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (MLflow v2.22.4.post2+tuxcare) is NOT vulnerable to CVE-2026-0545. The vulnerable feature (FastAPI job execution endpoints under /ajax-api/3.0/jobs/*) was introduced in MLflow v3.5.0 (September 2025), which is significantly later than the target version v2.22.4. The target repository does not contain the vulnerable code, job execution infrastructure, or FastAPI authentication middleware. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-0596 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-0596" }, "action_statement": "Vulnerability CVE-2026-0596 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-10803 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-10803" }, "action_statement": "Vulnerability CVE-2026-10803 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-27T21:38:34.791508+00:00", "status_notes": "Vulnerability CVE-2026-116691 affects version 2.22.4.post1+tuxcare of mlflow.", "vulnerability": { "name": "CVE-2026-116691" }, "action_statement": "Vulnerability CVE-2026-116691 affects version 2.22.4.post1+tuxcare of mlflow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2033 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-2033" }, "action_statement": "Vulnerability CVE-2026-2033 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2393 does not affect version 2.22.4.post1+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2393" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: Target repository version 2.22.4 does not contain the vulnerable webhook feature. Webhooks were introduced in MLflow v3.3.0 (commit 3094ab608b, August 2025), which is significantly after the target version. The vulnerable code pattern described in CVE-2026-2393 never existed in this version of the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2614 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-2614" }, "action_statement": "Vulnerability CVE-2026-2614 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2635 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-2635" }, "action_statement": "Vulnerability CVE-2026-2635 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2651 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-2651" }, "action_statement": "Vulnerability CVE-2026-2651 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-2652 does not affect version 2.22.4.post1+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-2652" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target repository (mlflow version 2.22.4) is NOT vulnerable to CVE-2026-2652. The vulnerable FastAPI authentication middleware code was introduced in version 3.9.0, which is significantly newer than the target version. In version 2.22.4, all routes are handled by Flask via WSGI middleware, eliminating the architectural mismatch between Flask and FastAPI authentication that causes this vulnerability. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-2734 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-2734" }, "action_statement": "Vulnerability CVE-2026-2734 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post11+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3198 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-3198" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-3198. The vulnerability describes missing authorization handlers for Gateway API protobuf endpoints (ListGatewaySecretInfos, ListGatewayEndpoints, ListGatewayModelDefinitions) in the BEFORE_REQUEST_HANDLERS dictionary when using basic-auth. However, version 2.22.4 uses a fundamentally different Gateway architecture - a separate FastAPI-based ser..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33865 does not affect version 2.22.4.post1+tuxcare of mlflow. Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33865" }, "impact_statement": "Frontend-only vulnerability; the TuxCare build ships no web UI. CVE-2026-33865 lives entirely in the MLflow JavaScript frontend (yaml.load -> yaml.safeLoad in ShowArtifactLoggedModelView.tsx and useValidateLoggedModelSignature.ts). Verified on the shipped artifact mlflow-2.22.4.post9+tuxcare-py3-none-any.whl (release pipeline 104717): 670 files, zero entries under mlflow/server/js/, no js/build directory, 6.0 MB against 27.7 MB for the upstream PyPI wheel of the same version. mlflow/server/__init__.py sets static_folder=\"js/build\" and guards on index.html existing, so the REST API is served and the UI page is absent. The vulnerable code is not present in what customers install." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33866 does not affect version 2.22.4.post1+tuxcare of mlflow. Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33866" }, "impact_statement": "Version 2.22.4 is not vulnerable. Summary: The target MLflow repository (version 2.22.4) does not contain the vulnerable 'Logged Models' feature described in CVE-2026-33866. This feature was introduced in MLflow 3.x, significantly after this version. The vulnerable AJAX artifact download endpoint and associated functionality do not exist in the codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4035 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4035" }, "action_statement": "Vulnerability CVE-2026-4035 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4137 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-4137" }, "action_statement": "Vulnerability CVE-2026-4137 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-10-23T21:53:32.735699+00:00", "status_notes": "Vulnerability CVE-2026-53995 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-53995" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 is not affected by CVE-2026-53995. While the codebase contains a potentially vulnerable mkdir() function that uses os.path.join without path traversal validation, user-supplied trace IDs never reach this dangerous operation. The start_trace endpoint generates trace IDs server-side via UUID (not user-controlled), and all endpoints that accept user-supplied trace IDs (end_tr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-64849 does not affect version 2.22.4.post1+tuxcare of mlflow. not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-64849" }, "impact_statement": "not_affected \u2014 MLflow version 2.22.4 does not contain the webhooks feature that is vulnerable to CVE-2026-64849. The webhooks functionality (including the webhook URL validation, HTTP delivery mechanism, and the `/api/2.0/mlflow/webhooks/{id}/test` endpoint) was introduced in version 3.4.0, which is significantly later than the target version 2.22.4. Without the webhooks feature, the SSRF vulnerability descri..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8147 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-8147" }, "action_statement": "Vulnerability CVE-2026-8147 affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/mlflow@2.22.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/mlflow@2.22.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare.", "vulnerability": { "name": "GHSA-gqvg-gmmx-x4hm" }, "action_statement": "Vulnerability GHSA-gqvg-gmmx-x4hm affects version 2.22.4.post1+tuxcare of mlflow, and is fixed in 2.22.4.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post14+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post14+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post14+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post14+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post14+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post14+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post14+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post14+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post14+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.10.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:08:50.506499+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 directory traversal vulnerability in Django Storage.save() is NOT present in the target. The security fix was introduced by upstream Django in December 2021 (commit 6d343d01c5) and shipped with Django 4.0.1, 3.2.11, and 2.2.26. Since the target is Django 5.1.10 (released in 2025), this fix has been part of the upstream codebase for years. All defense mechanisms are present and ac..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:57:57.136638+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 is not present in Django 5.1.10.post7+tuxcare. The vulnerability (unescaped HTML output in the {% debug %} template tag) was fixed by upstream Django in commit 394517f078 on 2022-01-02, over 4 years before TuxCare began maintaining this version. The target's DebugNode class contains all the security controls from the patch: HTML-escaping via escape() for both context values and s..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.10.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:18:47.843419+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2024-27351. The vulnerable regex pattern (r\"<[^>]+?>|([^<>\\s]+)\") that caused catastrophic backtracking was completely eliminated by an upstream architectural refactoring in Django 5.1. Commit 6ee37ada32 (Jan 2023) replaced the regex-based HTML truncation with Python's HTMLParser, and commit 3cadeea077 (Feb 2024) removed the now-unused vulnerable regex. Both..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.10.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 (timing attack for user enumeration via unusable passwords) is NOT present in Django 5.1.10. The vulnerability was fixed by upstream Django in commit f5d16483f3, which shipped in the upstream 5.1 release before TuxCare onboarding. The fix adds a standardized hashing operation (fake_runtime) in verify_password() to normalize response times when password checks short-circuit, preve..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:48:25.867512+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 does not affect Django 5.1.10. The fix for this directory traversal vulnerability was already present in the upstream Django 5.1.x release. The target repository at commit 9bce7312cd (version 5.1.10.post7+tuxcare) contains the complete fix: three validate_file_name() calls in Storage.save() method and backslash normalization in the validation function. This fix was authored by up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.10.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.10. The vulnerability (email enumeration via unhandled exceptions during password reset) was fixed by upstream Django in commit 3c733c78d6 before TuxCare onboarded the 5.1.x release. The fix wraps email_message.send() in exception handling at django/contrib/auth/forms.py:430-435, preventing email sending failures from propagating as distinguishable 50..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.10.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:32:17.905831+00:00", "status_notes": "Vulnerability CVE-2024-56374 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-56374" }, "impact_statement": "not_affected \u2014 Django 5.1.10.post7+tuxcare is not affected by CVE-2024-56374. The upstream fix (commit 4806731e58) was already included in the upstream Django 5.1.x release that TuxCare onboarded. The fix adds a 39-character length limit before IPv6 parsing, preventing denial-of-service attacks through excessively long IPv6 address strings. All three affected files (django/utils/ipv6.py, django/forms/fields.p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:04:00.101133+00:00", "status_notes": "Vulnerability CVE-2025-26699 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-26699" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare is not affected by CVE-2025-26699. The vulnerable nested-loop implementation in django.utils.text.wrap() has been replaced with Python's standard textwrap.TextWrapper module. This fix was authored by upstream Django (Sarah Boyce) and shipped in the upstream release that TuxCare onboarded, prior to any TuxCare modifications. The vulnerable code pattern is n..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:20:31.775552+00:00", "status_notes": "Vulnerability CVE-2025-27556 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-27556" }, "impact_statement": "not_affected \u2014 CVE-2025-27556 does not affect this Django 5.1.10.post7+tuxcare version because the upstream fix was already present in the Django 5.1.x release before TuxCare started maintaining this branch. The fix (commit edc2716d01) adds a MAX_URL_LENGTH check that rejects URLs exceeding 2048 characters before they reach urlparse, preventing CPU exhaustion from Unicode normalization. All three affected end..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:25:00.419267+00:00", "status_notes": "Vulnerability CVE-2025-32873 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32873" }, "impact_statement": "not_affected \u2014 Django 5.1.10 is not affected by CVE-2025-32873. The vulnerability affects Django 5.1 before 5.1.9, but this target is version 5.1.10. The fix for this DoS vulnerability in strip_tags() was already present in the upstream Django 5.1.9 release that TuxCare onboarded. The defensive regex pattern (long_open_tag_without_closing_re) and validation check are present in django/utils/html.py at lines 4..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:23:00.130027+00:00", "status_notes": "Vulnerability CVE-2025-48432 does not affect version 5.1.10.post3+tuxcare of django. not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-48432" }, "impact_statement": "not_affected \u2014 The target Django 5.1.10.post7+tuxcare already contains the CVE-2025-48432 fix. The core fix (unicode_escape encoding of logging arguments) was shipped in the upstream Django 5.1.10 release, authored by Natalia from the Django core team. The vulnerable pattern (unescaped request.path in logs allowing control character injection) is not present." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.10.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.10.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-10-09T09:04:00.111788+00:00", "status_notes": "Vulnerability CVE-2026-53878 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53878" }, "action_statement": "Vulnerability CVE-2026-53878 affects version 5.1.10.post3+tuxcare of django, and is fixed in 5.1.10.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.10.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.10.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.10.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post17+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post17+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post17+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post17+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post17+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post17+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post17+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post17+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post17+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-25673 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-25674 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-33033 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-33034 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-3902 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-4277 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-4292 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post17+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post17+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post17+tuxcare" } } ], "timestamp": "2026-10-19T06:58:00.201033+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 4.2.post17+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post8+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post8+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post8+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post8+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post8+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.5.0.post2+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:05:38.020126+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 CVE-2023-43804 (Cookie header leakage via cross-origin redirects) is not present in urllib3 2.5.0.post2+tuxcare. The upstream fix (commit 644124ec by quentin.pradet@gmail.com) shipped in the 2.5.0 release before TuxCare onboarding. The defense adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be automatically stripped during cross-host redirects. This defense is ena...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 CVE-2023-43804 (Cookie header leakage via cross-origin redirects) is not present in urllib3 2.5.0.post2+tuxcare. The upstream fix (commit 644124ec by quentin.pradet@gmail.com) shipped in the 2.5.0 release before TuxCare onboarding. The defense adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be automatically stripped during cross-host redirects. This defense is ena..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:15:22.334128+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 version 2.5.0.post2+tuxcare is NOT AFFECTED by CVE-2023-45803. The vulnerability (sending HTTP request body and content-specific headers to redirect targets on 303 status responses) does not exist in this version because the upstream vendor (urllib3 project) fixed it in versions 2.0.7 and 1.26.18, which predates TuxCare's onboarding of version 2.5.0. The complete defense is p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 The target urllib3 version 2.5.0.post2+tuxcare is NOT AFFECTED by CVE-2023-45803. The vulnerability (sending HTTP request body and content-specific headers to redirect targets on 303 status responses) does not exist in this version because the upstream vendor (urllib3 project) fixed it in versions 2.0.7 and 1.26.18, which predates TuxCare's onboarding of version 2.5.0. The complete defense is p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2024-37891 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 CVE-2024-37891 is NOT present in urllib3 2.5.0.post2+tuxcare. The vulnerability (leaking Proxy-Authorization header on cross-origin redirects) was fixed by upstream commit accff72e on June 17, 2024, which added \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT. This fix was already present in the upstream 2.5.0 release (June 18, 2025) that TuxCare onboarded. The target code at src/url...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-37891" }, "impact_statement": "not_affected \u2014 CVE-2024-37891 is NOT present in urllib3 2.5.0.post2+tuxcare. The vulnerability (leaking Proxy-Authorization header on cross-origin redirects) was fixed by upstream commit accff72e on June 17, 2024, which added \"Proxy-Authorization\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT. This fix was already present in the upstream 2.5.0 release (June 18, 2025) that TuxCare onboarded. The target code at src/url..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T15:56:31.162629+00:00", "status_notes": "Vulnerability CVE-2025-50181 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0 repository is NOT AFFECTED by CVE-2025-50181. The vulnerability was fixed in upstream commits f05b1329 and 7eb4a2aa, which were already present in the urllib3 2.5.0 release that TuxCare onboarded. Both the main fix (proper handling of the retries parameter in PoolManager.__init__ and using response.retries as fallback in urlopen) and the Emscripten/Node.js fix (setting ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50181" }, "impact_statement": "not_affected \u2014 The target urllib3 2.5.0 repository is NOT AFFECTED by CVE-2025-50181. The vulnerability was fixed in upstream commits f05b1329 and 7eb4a2aa, which were already present in the urllib3 2.5.0 release that TuxCare onboarded. Both the main fix (proper handling of the retries parameter in PoolManager.__init__ and using response.retries as fallback in urlopen) and the Emscripten/Node.js fix (setting ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:45:00.253277+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 2.5.0.post2+tuxcare of urllib3. not_affected \u2014 The target urllib3 2.5.0.post2+tuxcare is not affected by CVE-2025-50182. Both security fixes (PoolManager redirect control and Pyodide/Node.js Fetch API configuration) were already present in upstream urllib3 2.5.0 that TuxCare onboarded. The vulnerable pattern does not exist in the target code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 The target urllib3 2.5.0.post2+tuxcare is not affected by CVE-2025-50182. Both security fixes (PoolManager redirect control and Pyodide/Node.js Fetch API configuration) were already present in upstream urllib3 2.5.0 that TuxCare onboarded. The vulnerable pattern does not exist in the target code." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.5.0.post2+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 2.5.0.post2+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 2.5.0.post2+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post3+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post3+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post3+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.post3+tuxcare of django, and is fixed in 5.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:16:56.906709+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 concerns a symlink attack vulnerability in NumPy's f2py component where tempfile.mktemp() created a race condition allowing local attackers to write to arbitrary files. The vulnerability was fixed in upstream commit 0bb46c1448 by Julian Taylor, replacing insecure mktemp() with secure NamedTemporaryFile() and mkdtemp(). This fix was already present in upstream NumPy 2.1.3 when TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 concerns a symlink attack vulnerability in NumPy's f2py component where tempfile.mktemp() created a race condition allowing local attackers to write to arbitrary files. The vulnerability was fixed in upstream commit 0bb46c1448 by Julian Taylor, replacing insecure mktemp() with secure NamedTemporaryFile() and mkdtemp(). This fix was already present in upstream NumPy 2.1.3 when TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:25:00.405081+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1859 affects NumPy versions before 1.8.1 via insecure tempfile.mktemp() usage that allows symlink attacks. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerability was fixed upstream in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with secure alternatives (NamedTemporaryFile, mkdtemp, pytest fixtures). This fix shipped with the up...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 CVE-2014-1859 affects NumPy versions before 1.8.1 via insecure tempfile.mktemp() usage that allows symlink attacks. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerability was fixed upstream in commit 0bb46c1448 (Feb 2014) by Julian Taylor, replacing mktemp() with secure alternatives (NamedTemporaryFile, mkdtemp, pytest fixtures). This fix shipped with the up..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 2.1.3.post1+tuxcare of numpy." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2019-6446 affects version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" }, "action_statement": "Vulnerability CVE-2019-6446 affects version 2.1.3.post1+tuxcare of numpy." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:57:00.147500+00:00", "status_notes": "Vulnerability CVE-2021-33430 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-33430 does not affect NumPy 2.1.3. The buffer overflow vulnerability in PyArray_NewFromDescr_int when handling arrays with large dimensions (>32) was fixed upstream in May 2021 (commit 16f7824b4d9). The fix moved dimension validation before subarray processing that uses fixed-size stack buffers. This fix was already present in the upstream NumPy 2.1.3 release that TuxCare onboarded, so...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33430" }, "impact_statement": "not_affected \u2014 CVE-2021-33430 does not affect NumPy 2.1.3. The buffer overflow vulnerability in PyArray_NewFromDescr_int when handling arrays with large dimensions (>32) was fixed upstream in May 2021 (commit 16f7824b4d9). The fix moved dimension validation before subarray processing that uses fixed-size stack buffers. This fix was already present in the upstream NumPy 2.1.3 release that TuxCare onboarded, so..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:47:03.533601+00:00", "status_notes": "Vulnerability CVE-2021-34141 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 CVE-2021-34141 affects NumPy's dtype string parsing with an insecure prefix-matching pattern using strncmp. The vulnerability allowed attackers to bypass validation by crafting strings like \"Bytes0xxx\" that would match deprecated type names through prefix comparison only. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerable code was removed by upstream commit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-34141" }, "impact_statement": "not_affected \u2014 CVE-2021-34141 affects NumPy's dtype string parsing with an insecure prefix-matching pattern using strncmp. The vulnerability allowed attackers to bypass validation by crafting strings like \"Bytes0xxx\" that would match deprecated type names through prefix comparison only. The target repository (NumPy 2.1.3.post1+tuxcare) is NOT AFFECTED because the vulnerable code was removed by upstream commit..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:54:00.135057+00:00", "status_notes": "Vulnerability CVE-2021-41495 does not affect version 2.1.3.post1+tuxcare of numpy. not_affected \u2014 Target NumPy 2.1.3 is not affected by CVE-2021-41495. The vulnerability (missing NULL pointer validation after PyArray_DescrNew* calls) was fixed in upstream commit ac87f071f5 (Feb 2022) by Matti Picus, which was already included in the upstream NumPy 2.1.3 release that TuxCare onboarded. All critical code paths (methods.c array_sort, getset.c _get_part, descriptor.c, ctors.c) contain the requi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-41495" }, "impact_statement": "not_affected \u2014 Target NumPy 2.1.3 is not affected by CVE-2021-41495. The vulnerability (missing NULL pointer validation after PyArray_DescrNew* calls) was fixed in upstream commit ac87f071f5 (Feb 2022) by Matti Picus, which was already included in the upstream NumPy 2.1.3 release that TuxCare onboarded. All critical code paths (methods.c array_sort, getset.c _get_part, descriptor.c, ctors.c) contain the requi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 2.1.3.post1+tuxcare of numpy." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10001 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10001" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10002 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10002" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10003 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10003" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10004 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10004" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10005 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10006 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10006" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10007 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10007" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@2.1.3.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@2.1.3.post1+tuxcare" } } ], "timestamp": "2026-10-28T08:11:00.309252+00:00", "status_notes": "Vulnerability TUXVUL-2026-10008 is fixed in version 2.1.3.post1+tuxcare of numpy.", "vulnerability": { "name": "TUXVUL-2026-10008" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22815 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22815" }, "action_statement": "Vulnerability CVE-2022-22815 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22816 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2022-22816" }, "action_statement": "Vulnerability CVE-2022-22816 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22817 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2022-24303 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-45198 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T21:16:00.126689+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:06:00.205274+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T20:56:00.091985+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:06:00.101994+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 8.4.0.post4+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is not affected by CVE-2026-112396. The vulnerability requires freeing the buffer before closing the TIFF handle, allowing TIFFClose to write to freed memory during flush. Version 8.4.0 has a different architecture than vulnerable versions: it has no separate cleanup function and calls TIFFClose BEFORE freeing data in all error paths (lines 979\u2192981, 996\u2192998, 1003\u21921022), preventing..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:14.105080+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:00.092889+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-112898 does not affect version 8.4.0.post4+tuxcare of pillow. not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-112898" }, "impact_statement": "not_affected \u2014 Version 8.4.0 is NOT AFFECTED by CVE-2026-112898. The vulnerability was introduced in commit 54cb09d8b (first released in 9.1.0) and does not exist in version 8.4.0. The target version uses a fundamentally different palette architecture: it lacks the `palette->size` field entirely, and `ImagingPaletteCacheUpdate()` always loops 256 times (hardcoded `for (i = 0; i < 256; i++)`), not `palette->si..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T05:54:12.296647+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:56:03.730868+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T21:42:03.750234+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:24:57.901478+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 8.4.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 CVE-2026-114501 affects Pillow's Arrow export functionality, which leaks uninitialized heap memory when PILLOW_ALIGNMENT > 1. However, the target version 8.4.0.post12+tuxcare does NOT contain Arrow export functionality. Arrow support was introduced in commit 5c76e7ec17813eefaa1fdd8948e0165ee644e11f and first appeared in version 11.2.1+. Version 8.4.0 predates this feature by several major relea..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:23:37.556546+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 8.4.0.post4+tuxcare of pillow. not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target Pillow version 8.4.0.post12+tuxcare is not affected by CVE-2026-42309. This vulnerability was introduced in Pillow 11.2.1 (commit 5ba72a9b5 \"Allow coords to be sequence of lists\", March 6, 2025) when recursive list handling was added to the assign_item_to_array function. The target version 8.4.0 predates this change and does not contain the vulnerable recursive unpacking code. In ver..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T14:43:41.647513+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T07:51:42.012949+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T16:53:59.173919+00:00", "status_notes": "Vulnerability CVE-2026-96638 does not affect version 8.4.0.post4+tuxcare of pillow. not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-96638" }, "impact_statement": "not_affected \u2014 Pillow 8.4.0 does not support RLE-compressed BMP files at all. The vulnerable BmpRleDecoder class and its decode() method do not exist in this version. RLE8 and RLE4 compression support was added to Pillow in March 2022 (commit 0ace3fcd2), after version 8.4.0 was released in October 2021. When an RLE-compressed BMP file is opened in version 8.4.0, it is immediately rejected with \"Unsupported BM..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "action_statement": "Vulnerability GHSA-4fx9-vc88-q2xc affects version 8.4.0.post4+tuxcare of pillow, and is fixed in 8.4.0.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 8.4.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@8.4.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@8.4.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post4+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 8.4.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:11:18.249311+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T11:00:44.283174+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:03:58.017414+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post16+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T12:34:26.611716+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T07:46:00.278398+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:03:43.925419+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T11:04:00.150729+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post15+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T11:34:52.577982+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 10.4.0.post2+tuxcare of pillow, and is fixed in 10.4.0.post14+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post2+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post2+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 4.2.post2+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 4.2.post2+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2021-45452. The vulnerability was fixed in the upstream Django release before version 4.2.0 was published. All security defenses from the patch (backslash normalization, path traversal detection, post-save validation, and relative path enforcement) are present in the target codebase. The fix was authored by upstream Django maintainers and shipped in the base ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-29T19:58:08.504070+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 4.2.post2+tuxcare of django. not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 4.2 is not affected by CVE-2022-22818. The vulnerability in the `{% debug %}` template tag (unescaped output leading to XSS) was fixed in upstream Django before the 4.2 release. The fix commit 394517f07886495efcf79f95c7ee402a9437bd68 by Markus Holtermann is present in HEAD and predates all TuxCare work on this branch. The target code properly escapes all pformat() output and includes a D..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T08:08:00.236952+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post18+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post18+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 4.2.post2+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-19T06:59:00.113234+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 4.2.post2+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 4.2.post2+tuxcare of django. not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 4.2.0 is not affected by CVE-2026-53878. The vulnerable component `DomainNameValidator` does not exist in this version (it was introduced in Django 5.1). All existing domain validation mechanisms in Django 4.2.0 already prohibit newlines: URLValidator explicitly checks for newlines in `unsafe_chars`, EmailValidator uses regex that doesn't match newlines, and _simple_domain_name_validator..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-29T07:42:00.149028+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@4.2.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/django@4.2.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 4.2.post2+tuxcare of django, and is fixed in 4.2.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-43804 affects version 1.26.4.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-43804" }, "action_statement": "Vulnerability CVE-2023-43804 affects version 1.26.4.post1+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45803 is fixed in version 1.26.4.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2023-45803" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-37891 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-37891" }, "action_statement": "Vulnerability CVE-2024-37891 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-50181 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-50181" }, "action_statement": "Vulnerability CVE-2025-50181 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post4+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:46:00.162255+00:00", "status_notes": "Vulnerability CVE-2025-50182 does not affect version 1.26.4.post1+tuxcare of urllib3. not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-50182" }, "impact_statement": "not_affected \u2014 CVE-2025-50182 affects urllib3's Pyodide/Emscripten support, which does not exist in urllib3 1.26.4. The contrib/emscripten module that enables urllib3 usage in Pyodide runtimes (browser/Node.js via JavaScript Fetch API or XMLHttpRequest) was introduced in urllib3 2.x and is completely absent from the 1.26.4 branch. Without this module, the vulnerability\u2014where redirect control parameters are ig..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66418 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66418" }, "action_statement": "Vulnerability CVE-2025-66418 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66471 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare.", "vulnerability": { "name": "CVE-2025-66471" }, "action_statement": "Vulnerability CVE-2025-66471 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-21441 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-21441" }, "action_statement": "Vulnerability CVE-2026-21441 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44431 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-44431" }, "action_statement": "Vulnerability CVE-2026-44431 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 1.26.4.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 1.26.4.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97687 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97687" }, "action_statement": "Vulnerability CVE-2026-97687 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-97688 affects version 1.26.4.post1+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97688" }, "action_statement": "Vulnerability CVE-2026-97688 affects version 1.26.4.post1+tuxcare of urllib3." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@1.26.4.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@1.26.4.post1+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-97689 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-97689" }, "action_statement": "Vulnerability CVE-2026-97689 affects version 1.26.4.post1+tuxcare of urllib3, and is fixed in 1.26.4.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.post15+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T19:04:43.966915+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.post15+tuxcare of django. not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 CVE-2021-45452 (directory traversal in Storage.save()) is NOT present in Django 5.0.0.post20+tuxcare. The upstream fix (commit 6d343d01c5 by Florian Apolloner) shipped in Django 5.0.0 and predates all TuxCare commits in this branch. All defense mechanisms are present: backslash normalization (base.py:75,116), path traversal detection (base.py:77-80,119-122), relative path enforcement (filesyste..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-29T19:54:18.808151+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.post15+tuxcare of django. not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 5.0 repository is NOT AFFECTED by CVE-2022-22818. The vulnerability (XSS via unescaped output in the {% debug %} template tag) was fixed by Django upstream in commit 394517f078 on 2022-01-02, three years before this Django 5.0 release. The fix\u2014which wraps pformat() output with HTML entity encoding via escape() and blocks output when DEBUG=False\u2014is present at django/template/de..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-27351 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-27351" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-38875 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-39330 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-39614 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-41990 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-42005 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45230 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-53907 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-53908 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-01T09:09:01.183793+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post16+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.post15+tuxcare of django, and is fixed in 5.0.post16+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.post15+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.post15+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.post15+tuxcare of django. not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0 does not contain the vulnerable DomainNameValidator class. This validator was introduced in Django 5.1 (commit 4971a9afe5). Since the specific component affected by CVE-2026-53878 does not exist in this version, Django 5.0 cannot be affected by this vulnerability. Additionally, all domain validators present in Django 5.0 (_simple_domain_name_validator, EmailValidator, URLValidator) a..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.post15+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.post15+tuxcare" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.0.post15+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-10-29T21:37:00.115870+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.3.8.post2+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in Werkzeug 2.3.8. The vulnerability allowed attackers to set nameless cookies like '=__Host-test=bad' that would be parsed as legitimate named cookies. The fix (commit 093aa409 by upstream author David Lord) is present in the target at /src/werkzeug/sansio/http.py lines 187-188, which discards cookies with empty keys via 'if not ck: continue'. This upstream fix wa..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.3.8.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.3.8.post2+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.3.8.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.3.8.post2+tuxcare of werkzeug." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 is fixed in version 2.3.8.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-34069" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49766" }, "action_statement": "Vulnerability CVE-2024-49766 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2024-49767" }, "action_statement": "Vulnerability CVE-2024-49767 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66221 is fixed in version 2.3.8.post2+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2025-66221" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.3.8.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 2.3.8.post2+tuxcare of werkzeug, and is fixed in 2.3.8.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10085 is fixed in version 2.2.3.post3+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10085" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2024-10410 is fixed in version 2.2.3.post3+tuxcare of werkzeug.", "vulnerability": { "name": "AIKIDO-2024-10410" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:35:58.653636+00:00", "status_notes": "Vulnerability CVE-2023-23934 does not affect version 2.2.3.post3+tuxcare of werkzeug. not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-23934" }, "impact_statement": "not_affected \u2014 CVE-2023-23934 is not present in this target. The vulnerability allowed browsers to send nameless cookies like `=__Host-test=bad`, which Werkzeug \u22642.2.2 incorrectly parsed by stripping the leading `=`, enabling cookie security bypass. The upstream fix (commit 093aa409 by David Lord) was already present in Werkzeug 2.2.3, which TuxCare onboarded. The fix changes the cookie regex from `(?P[^..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:10:05.488784+00:00", "status_notes": "Vulnerability CVE-2023-25577 affects version 2.2.3.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2023-25577" }, "action_statement": "Vulnerability CVE-2023-25577 affects version 2.2.3.post3+tuxcare of werkzeug." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-46136 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post4+tuxcare.", "vulnerability": { "name": "CVE-2023-46136" }, "action_statement": "Vulnerability CVE-2023-46136 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-34069 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-34069" }, "action_statement": "Vulnerability CVE-2024-34069 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49766 is fixed in version 2.2.3.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49766" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-49767 is fixed in version 2.2.3.post3+tuxcare of werkzeug.", "vulnerability": { "name": "CVE-2024-49767" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2025-66221 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-66221" }, "action_statement": "Vulnerability CVE-2025-66221 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-10-07T10:48:00.634805+00:00", "status_notes": "Vulnerability CVE-2026-102598 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102598" }, "action_statement": "Vulnerability CVE-2026-102598 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-21860 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-21860" }, "action_statement": "Vulnerability CVE-2026-21860 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/werkzeug@2.2.3.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-27199 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-27199" }, "action_statement": "Vulnerability CVE-2026-27199 affects version 2.2.3.post3+tuxcare of werkzeug, and is fixed in 2.2.3.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post4+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post4+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post4+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post4+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post4+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post4+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post4+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post4+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post4+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.0.1.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:06:27.602422+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.0.1.post3+tuxcare of django. not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post14+tuxcare is NOT affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was already fixed in the upstream release before TuxCare onboarded this version. All four critical protections are present: (1) backslash-to-forward-slash normalization in get_available_name() and generate_filename(), (2) \"..\" path component validation, (3) post-save path valid..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:54:13.197017+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.0.1.post3+tuxcare of django. not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 CVE-2022-22818 affects Django's {% debug %} template tag, which failed to HTML-escape template context data before rendering, enabling XSS attacks. The target repository (Django 5.0.1.post14+tuxcare) is NOT AFFECTED because the upstream fix was already present in Django 5.0.1 when TuxCare onboarded this version. The fix (commit 394517f078) was authored by Django maintainer Markus Holtermann on ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.0.1.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-24680 is fixed in version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-27351 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-27351" }, "action_statement": "Vulnerability CVE-2024-27351 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39329 is fixed in version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41989 is fixed in version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41990 does not affect version 5.0.1.post3+tuxcare of django. not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41990" }, "impact_statement": "not_affected \u2014 Django 5.0.1.post3+tuxcare uses a refactored architecture that does not contain the vulnerable code pattern from CVE-2024-41990. The target implementation uses html.unescape() upfront, while the CVE affects a different implementation with repeated rfind() calls that was introduced later in Django 5.0.7." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-41991 is fixed in version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-01T04:49:00.278202+00:00", "status_notes": "Vulnerability CVE-2025-57833 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare.", "vulnerability": { "name": "CVE-2025-57833" }, "action_statement": "Vulnerability CVE-2025-57833 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2025-64458" }, "action_statement": "Vulnerability CVE-2025-64458 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2025-64459" }, "action_statement": "Vulnerability CVE-2025-64459 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.0.1.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.0.1.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 5.0.1.post3+tuxcare of django. not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 5.0.1 is not affected by CVE-2026-53878. The CVE describes a vulnerability in the DomainNameValidator class introduced in Django 5.1, where regex patterns without proper anchors allowed domains containing newlines to pass validation. Django 5.0.1 does not have this class. All domain validation mechanisms in 5.0.1 (_simple_domain_name_validator, EmailValidator.domain_regex, URLValidator.u..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.0.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.0.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 5.0.1.post3+tuxcare of django, and is fixed in 5.0.1.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:13:00.146708+00:00", "status_notes": "Vulnerability CVE-2014-1858 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 CVE-2014-1858 is not present in numpy 1.21.0. The vulnerability involved insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448) was applied upstream by Julian Taylor on 2014-02-05 and shipped in numpy 1.8.1. The target version (1.21.0, released 2021) contains the fix as part of the upstream release. Both vulnerable locations now use secure alternativ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1858" }, "impact_statement": "not_affected \u2014 CVE-2014-1858 is not present in numpy 1.21.0. The vulnerability involved insecure use of tempfile.mktemp() in f2py that allowed symlink attacks. The fix (commit 0bb46c1448) was applied upstream by Julian Taylor on 2014-02-05 and shipped in numpy 1.8.1. The target version (1.21.0, released 2021) contains the fix as part of the upstream release. Both vulnerable locations now use secure alternativ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:20:21.477460+00:00", "status_notes": "Vulnerability CVE-2014-1859 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 The target NumPy version 1.21.0.post1+tuxcare is NOT affected by CVE-2014-1859. The vulnerable pattern (insecure tempfile.mktemp() usage) was removed by upstream commit 0bb46c1448 in February 2014, well before version 1.21.0 was released (June 2021). All affected files now use secure alternatives: NamedTemporaryFile(), mkdtemp(), and mkstemp(). Comprehensive searches confirm zero mktemp usage i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1859" }, "impact_statement": "not_affected \u2014 The target NumPy version 1.21.0.post1+tuxcare is NOT affected by CVE-2014-1859. The vulnerable pattern (insecure tempfile.mktemp() usage) was removed by upstream commit 0bb46c1448 in February 2014, well before version 1.21.0 was released (June 2021). All affected files now use secure alternatives: NamedTemporaryFile(), mkdtemp(), and mkstemp(). Comprehensive searches confirm zero mktemp usage i..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:13:55.687660+00:00", "status_notes": "Vulnerability CVE-2017-12852 affects version 1.21.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2017-12852" }, "action_statement": "Vulnerability CVE-2017-12852 affects version 1.21.0.post1+tuxcare of numpy." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2019-6446 affects version 1.21.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2019-6446" }, "action_statement": "Vulnerability CVE-2019-6446 affects version 1.21.0.post1+tuxcare of numpy." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:53:00.139615+00:00", "status_notes": "Vulnerability CVE-2021-33430 does not affect version 1.21.0.post1+tuxcare of numpy. not_affected \u2014 NumPy 1.21.0 is not affected by CVE-2021-33430. The vulnerability was a buffer overflow in PyArray_NewFromDescr_int when processing arrays with dimensions exceeding NPY_MAXDIMS (32). The issue occurred because dimension validation happened AFTER entering code paths that used fixed-size buffers. The upstream fix (commit 16f7824b4d) moved dimension validation to occur immediately at function entr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-33430" }, "impact_statement": "not_affected \u2014 NumPy 1.21.0 is not affected by CVE-2021-33430. The vulnerability was a buffer overflow in PyArray_NewFromDescr_int when processing arrays with dimensions exceeding NPY_MAXDIMS (32). The issue occurred because dimension validation happened AFTER entering code paths that used fixed-size buffers. The upstream fix (commit 16f7824b4d) moved dimension validation to occur immediately at function entr..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-34141 is fixed in version 1.21.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-34141" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2021-41495 affects version 1.21.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41495" }, "action_statement": "Vulnerability CVE-2021-41495 affects version 1.21.0.post1+tuxcare of numpy." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/numpy@1.21.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/numpy@1.21.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2021-41496 affects version 1.21.0.post1+tuxcare of numpy.", "vulnerability": { "name": "CVE-2021-41496" }, "action_statement": "Vulnerability CVE-2021-41496 affects version 1.21.0.post1+tuxcare of numpy." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 11.3.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target repository (Pillow 11.3.0.post12+tuxcare) already contains the upstream fixes (commits 1e092419b and c48271ab3) that were released in Pillow 9.0.0 on 2022-01-02. The vulnerable code patterns (malloc instead of calloc, missing count==0 check) are not present in the target. The fixes were authore..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:39:00.146468+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 11.3.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0. The target is Pillow 11.3.0.post12+tuxcare, which contains upstream fixes that prevent the buffer over-read vulnerability. Both required fixes are present: (1) calloc initialization at src/path.c:61 replaces malloc to zero-initialize memory, and (2) bounds check at src/path.c:359-362 prevents accessing xy[0] and xy[1] when count is 0. These fixes were..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:07:45.909709+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 11.3.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 is NOT present in the target repository at version 11.3.0 (SHA 388e73f2e). The vulnerability involved buffer overflow via strcpy() in src/_imagingcms.c when copying mode strings into fixed-size buffers. The upstream fix (commit 2a93aba5c by Andrew Murray, merged April 1, 2024) replaced strcpy with strncpy, and this fix was already present in the upstream release before TuxCare's ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 11.3.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:56:00.096918+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T09:58:00.076982+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:55:08.696572+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-114501 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-114501" }, "action_statement": "Vulnerability CVE-2026-114501 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-08T08:00:54.886694+00:00", "status_notes": "Vulnerability CVE-2026-42309 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-42309" }, "action_statement": "Vulnerability CVE-2026-42309 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T09:31:07.524695+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T14:21:57.584366+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post11+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T08:23:33.984637+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 11.3.0.post3+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:41:52.890414+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 11.3.0.post3+tuxcare of pillow. not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin when processing truncated JPEG files) is NOT present in Pillow 11.3.0.post12+tuxcare. The fix was already included in the upstream Pillow 11.3.0 release before TuxCare onboarded it. The defense code at src/PIL/JpegImagePlugin.py:417-421 prevents infinite loops by tracking whether an EOF marker has already been returned via ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@11.3.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@11.3.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T20:12:00.120810+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post3+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "impact_statement": "not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2021-33503 affects version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2021-33503" }, "action_statement": "Vulnerability CVE-2021-33503 affects version 2.0.7.post4+tuxcare of urllib3." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:05:58.294427+00:00", "status_notes": "Vulnerability CVE-2023-43804 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-43804" }, "impact_statement": "not_affected \u2014 Target version 2.0.7.post4+tuxcare is not affected by CVE-2023-43804. The vulnerability (Cookie header leakage on cross-origin redirects) was fixed in upstream version 2.0.6 by commit 644124ec (Oct 2, 2023) authored by upstream maintainer Quentin Pradet. The fix adds \"Cookie\" to DEFAULT_REMOVE_HEADERS_ON_REDIRECT, causing Cookie headers to be stripped when redirects cross to different hosts. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:13:58.377643+00:00", "status_notes": "Vulnerability CVE-2023-45803 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45803" }, "impact_statement": "not_affected \u2014 CVE-2023-45803 is not present in this target. The vulnerability (HTTP request body leak on 303 redirects) was fixed in upstream urllib3 version 2.0.7 on October 17, 2023 (commit 4e50fbc5 by illia.volochii@gmail.com). The target version 2.0.7.post4+tuxcare is based on this upstream 2.0.7 release which already contained the fix before TuxCare onboarded it (first TuxCare commit fa2c5b17 on Dec 30,..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2024-37891 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2024-37891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2025-50181 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50181" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2025-50182 affects version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-50182" }, "action_statement": "Vulnerability CVE-2025-50182 affects version 2.0.7.post4+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2025-66418 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66418" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2025-66471 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2025-66471" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2026-21441 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-21441" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:54:00.136665+00:00", "status_notes": "Vulnerability CVE-2026-44431 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44431" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:25:38.085266+00:00", "status_notes": "Vulnerability CVE-2026-44432 affects version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-44432" }, "action_statement": "Vulnerability CVE-2026-44432 affects version 2.0.7.post4+tuxcare of urllib3." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97687 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97687" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:12:00.131811+00:00", "status_notes": "Vulnerability CVE-2026-97688 does not affect version 2.0.7.post4+tuxcare of urllib3. not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-97688" }, "impact_statement": "not_affected \u2014 Target urllib3 version 2.0.7 does not contain the vulnerable code pattern. CVE-2026-97688 affects versions 2.6.2-2.7.0 due to a sophisticated buffering mechanism with `_unfed_data` buffer and `has_unconsumed_tail` property that causes infinite loops when processing deflate responses with trailing bytes. Version 2.0.7 uses a much simpler DeflateDecoder without these components, and its streaming..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/urllib3@2.0.7.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/urllib3@2.0.7.post4+tuxcare" } } ], "timestamp": "2026-10-01T05:55:00.904119+00:00", "status_notes": "Vulnerability CVE-2026-97689 is fixed in version 2.0.7.post4+tuxcare of urllib3.", "vulnerability": { "name": "CVE-2026-97689" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post6+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post7+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post6+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post3+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.3.2.post3+tuxcare of setuptools. not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 The target setuptools version 75.3.2 is not affected by CVE-2022-40897. The vulnerability (ReDoS via unbounded whitespace in REL regex) was fixed in upstream version 65.5.1 (November 2022). The target contains the fixed regex pattern with bounded whitespace quantifiers (\\s{0,10}) instead of the vulnerable unbounded pattern (\\s*). The fix was already present in the upstream release 75.3.2 that T..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.3.2.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.3.2.post3+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.3.2.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59890 is fixed in version 75.3.2.post3+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2026-59890" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.3.2.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.3.2.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w is fixed in version 75.3.2.post3+tuxcare of setuptools.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post7+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post7+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 5.1.4.post7+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 5.1.4.post7+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 5.1.4.post7+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 5.1.4.post7+tuxcare of django, and is fixed in 5.1.4.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post7+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post7+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post7+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post7+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T21:33:00.073558+00:00", "status_notes": "Vulnerability CVE-2022-40897 does not affect version 75.0.0.post1+tuxcare of setuptools. not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-40897" }, "impact_statement": "not_affected \u2014 CVE-2022-40897 (ReDoS in setuptools package_index REL regex) is NOT present in the target. The vulnerability was fixed in upstream setuptools 65.5.1 (commit 43a9c9b by Jason R. Coombs, Nov 2022), which limited whitespace quantifiers from unbounded `\\s*` to bounded `\\s{0,10}` to prevent catastrophic backtracking. The target version 75.0.0 already contains this upstream fix - it was shipped in th..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2024-6345 affects version 75.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2024-6345" }, "action_statement": "Vulnerability CVE-2024-6345 affects version 75.0.0.post1+tuxcare of setuptools." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-47273 is fixed in version 75.0.0.post1+tuxcare of setuptools.", "vulnerability": { "name": "CVE-2025-47273" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T06:26:00.226980+00:00", "status_notes": "Vulnerability CVE-2026-59890 affects version 75.0.0.post1+tuxcare of setuptools, and is fixed in 75.0.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2026-59890" }, "action_statement": "Vulnerability CVE-2026-59890 affects version 75.0.0.post1+tuxcare of setuptools, and is fixed in 75.0.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/setuptools@75.0.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/setuptools@75.0.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T07:30:11.126719+00:00", "status_notes": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.0.0.post1+tuxcare of setuptools, and is fixed in 75.0.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-xmj3-9gf7-h52w" }, "action_statement": "Vulnerability GHSA-xmj3-9gf7-h52w affects version 75.0.0.post1+tuxcare of setuptools, and is fixed in 75.0.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post6+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 is fixed in version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45231" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post6+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post6+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post6+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post6+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post6+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post6+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 5.1.4.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:07:59.324773+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 Django 5.1.4.post10+tuxcare is not affected by CVE-2021-45452. The directory traversal vulnerability in Storage.save() was fixed in upstream Django commit 6d343d01c5 (Dec 2021) by Florian Apolloner, which was already present in the Django 5.1.4 upstream release before TuxCare's maintenance began. All protection mechanisms from the fix are present and active in the target: path normalization, \"...." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:55:14.707436+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2022-22818. The vulnerability (XSS via unescaped output in {% debug %} template tag) was fixed in Django 4.0.2, 3.2.12, and 2.2.27. The target version 5.1.4 already contains the upstream fix from commit 394517f078 by Markus Holtermann, which was shipped in the upstream release before TuxCare's onboarding. The DebugNode.render() method properly HTML-encodes al..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 5.1.4.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:18:06.334068+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 Django 5.1.4 is not affected by CVE-2024-27351. The vulnerable regex pattern `r\"<[^>]+?>|([^<>\\s]+)\"` used in `Truncator.words()` was removed in January 2023 (commit 6ee37ada32) when Django switched to HTMLParser-based truncation. Django 5.1 branched from main after this architectural change, so 5.1.4 never contained the vulnerable code. The CVE only affected older branches (3.2, 4.2, 5.0) that..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 5.1.4.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T19:13:00.100912+00:00", "status_notes": "Vulnerability CVE-2024-39329 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39329" }, "impact_statement": "not_affected \u2014 CVE-2024-39329 timing attack vulnerability is NOT present in Django 5.1.4. The fix (commit f5d16483f3) was already included in the upstream Django 5.1.4 release before TuxCare began maintaining this version. The vulnerable code pattern has been replaced with timing-normalized code that calls make_password() to equalize response times for unusable passwords." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T20:46:09.941779+00:00", "status_notes": "Vulnerability CVE-2024-39330 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39330" }, "impact_statement": "not_affected \u2014 CVE-2024-39330 is not present in Django 5.1.4. The upstream fix (commit 6d36203648) that adds three validate_file_name() calls in Storage.save() and backslash normalization in validate_file_name() was already included in the Django 5.1.4 release before TuxCare onboarded it. The vulnerable pattern (missing path traversal validation allowing directory traversal via \"..\" or absolute paths) is not ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 5.1.4.post8+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-29T18:43:56.275811+00:00", "status_notes": "Vulnerability CVE-2024-45231 does not affect version 5.1.4.post8+tuxcare of django. not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-45231" }, "impact_statement": "not_affected \u2014 CVE-2024-45231 is NOT present in Django 5.1.4. The vulnerability allowed email enumeration when password reset email sending failed, causing observable 500 errors. The upstream Django fix (commit 3c733c78d6 by Natalia) wraps email_message.send() in a try-except block that catches and logs exceptions instead of propagating them. This fix was already present in the Django 5.1.4 upstream release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 5.1.4.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2024-56374 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-13372 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-13473 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-14550 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-26699 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-27556 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-32873 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-48432 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-48432" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-59681 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-59682 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2025-64460 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-1207 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-1285 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-1287 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-1312 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15307 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15307" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-15830 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-15830" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 5.1.4.post8+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 5.1.4.post8+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48587 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48587" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-48588 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-48588" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-53877 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53877" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-53878 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-53878" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-6873 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-6873" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@5.1.4.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/django@5.1.4.post8+tuxcare" } } ], "timestamp": "2026-10-01T08:48:43.786965+00:00", "status_notes": "Vulnerability CVE-2026-8404 is fixed in version 5.1.4.post8+tuxcare of django.", "vulnerability": { "name": "CVE-2026-8404" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-29217 is fixed in version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-30T00:27:05.135813+00:00", "status_notes": "Vulnerability CVE-2026-101917 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-101917" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-101917. The vulnerability concerns PyJWKClient's unbounded JWKS endpoint refresh mechanism triggered by unknown key IDs, enabling unauthenticated DoS attacks. PyJWT version 1.7.1 predates the introduction of the PyJWKClient class entirely - the jwt/jwks_client.py module does not exist, and there is no JWKS endpoint fetching functionality. While this versi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-30T01:08:30.473565+00:00", "status_notes": "Vulnerability CVE-2026-102267 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102267" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1.post3+tuxcare is not affected by CVE-2026-102267. The vulnerability affects the PyJWKClient class in jwt/jwks_client.py, which fetches JWKS over HTTP and incorrectly follows redirects. This feature does not exist in version 1.7.1 - the PyJWKClient class and jwt/jwks_client.py module were introduced in later versions of PyJWT (after 1.7.1). The target version lacks any HTTP client fu..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102268 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102268" }, "action_statement": "Vulnerability CVE-2026-102268 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102269 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102269" }, "action_statement": "Vulnerability CVE-2026-102269 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102270 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-102270" }, "action_statement": "Vulnerability CVE-2026-102270 affects version 1.7.1.post3+tuxcare of pyjwt, and is fixed in 1.7.1.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2026-102271 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" }, "action_statement": "Vulnerability CVE-2026-102271 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 1.7.1.post3+tuxcare of pyjwt." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:01:25.383481+00:00", "status_notes": "Vulnerability CVE-2026-102274 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102274" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-102274. The vulnerability requires JWK Set parsing infrastructure (PyJWK, PyJWKSet, PyJWKClient classes in jwt/api_jwk.py) that was not yet implemented in version 1.7.1. While the underlying RSAAlgorithm.from_jwk() method that can raise ValueError exists in jwt/algorithms.py, there is no JWK Set iteration logic that would exhibit the vulnerable behavior..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:55:32.070148+00:00", "status_notes": "Vulnerability CVE-2026-102275 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-102275" }, "impact_statement": "not_affected \u2014 Target version 1.7.1.post4+tuxcare predates OKP/EdDSA support entirely. The OKPAlgorithm class and Ed25519/Ed448 key handling were introduced in PyJWT 2.1.0 (per CVE). Version 1.7.1 has no code to receive or process OKP private JWKs, making the vulnerability impossible to manifest. The CVE's affected range (>= 2.1.0, <= 2.14.0) explicitly excludes this older version. Exhaustive searches confirm..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:40:00.157608+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by CVE-2026-103001. The vulnerability pattern (conditional mutation of verify_exp/nbf/iat/aud/iss/sub/jti flags based on verify_signature=False) was introduced in PR #1045 (merged 2025-03-05) via the _merge_options() method. Version 1.7.1 predates this architectural change and uses merge_dict() utility which creates copies instead of mutating caller-supplied dicts. E..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "not_affected \u2014 Version 1.7.1 is not affected by CVE-2026-48522. The vulnerability concerns PyJWKClient accepting non-HTTP(S) URL schemes (file://, ftp://, data:) without validation, enabling local file read and SSRF. However, PyJWKClient class does not exist in version 1.7.1 - it was introduced in later versions (tested vulnerable in 2.11.0 and 2.12.1). The affected component and its entire remote JWKS fetchi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-29T16:56:01.041112+00:00", "status_notes": "Vulnerability CVE-2026-48523 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-48523" }, "impact_statement": "not_affected \u2014 Target version 1.7.1 is not affected by CVE-2026-48523. The vulnerability requires the PyJWK class introduced in version 2.9.0 (commit ab8176a). The target predates this feature and has no PyJWK class, no api_jwk.py module, and no isinstance(key, PyJWK) verification path. The target's architecture always uses the algorithm from the JWT header for verification, making the \"algorithm mismatch via..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48524 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48524" }, "impact_statement": "not_affected \u2014 PyJWT version 1.7.1 is not affected by CVE-2026-48524. The vulnerability concerns PyJWKClient.fetch_data() clearing the JWKS cache on fetch errors, enabling unlimited HTTP requests. PyJWKClient was introduced in PyJWT 2.0.0 (2021), and this target version 1.7.1 (2018) predates that feature entirely. No JWKS fetching capability, no cache mechanism, and no code path exists for the vulnerability p..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-29T07:30:18.436677+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 1.7.1.post3+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@1.7.1.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:26:00.574021+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 does not affect version 1.7.1.post3+tuxcare of pyjwt. not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "impact_statement": "not_affected \u2014 PyJWT 1.7.1 is not affected by GHSA-pxh4-856f-4h89. The CVE describes a vulnerability where PyJWK/PyJWKSet/PyJWKClient classes bypass the prepare_key() empty-key defense when resolving HMAC keys from JWKs, allowing empty-key forgery attacks. Version 1.7.1 lacks this architectural pattern entirely\u2014PyJWK classes were introduced in later 2.x versions. All documented verification flows in 1.7.1 go ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:36:26.421347+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 The target Pillow 10.4.0.post17+tuxcare is not affected by CVE-2022-22815. The vulnerability (uninitialized memory access in path.c's path_getbbox function) was fixed by the upstream Pillow project in version 9.0.0 (December 2021). Both required fixes are present in the target: (1) alloc_array uses calloc for zero-initialization (line 60), and (2) path_getbbox explicitly handles count==0 before..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:39:30.920467+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 affects Pillow before 9.0.0 due to a buffer over-read in path_getbbox when a path has zero coordinates. The target version is 10.4.0.post17+tuxcare, which already contains the upstream fixes from commits c48271ab3 and 1e092419b. These fixes (1) use calloc instead of malloc to zero-initialize the coordinate array, and (2) check if count==0 before accessing xy[0] and xy[1]. Both fi..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:58:17.320145+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:59:36.443819+00:00", "status_notes": "Vulnerability CVE-2023-4863 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" }, "action_statement": "Vulnerability CVE-2023-4863 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2023-50447 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" }, "action_statement": "Vulnerability CVE-2023-50447 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:07:55.660741+00:00", "status_notes": "Vulnerability CVE-2024-28219 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-28219" }, "impact_statement": "not_affected \u2014 CVE-2024-28219 describes a buffer overflow in _imagingcms.c caused by strcpy being used instead of strncpy when copying mode strings into fixed-size mode_in/mode_out buffers (8 bytes each) in the CmsTransformObject structure. The target repository (Pillow 10.4.0.post17+tuxcare) is not affected because the vulnerable code pattern was completely removed in upstream commit 16ce3da0a (by Yay295@gma..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2026-112396 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112396" }, "action_statement": "Vulnerability CVE-2026-112396 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112893 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:31.687894+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:28:32.433960+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Pillow 10.4.0 does not contain Arrow export functionality. The vulnerability (CVE-2026-114501) is specific to the Arrow export mechanism that exports image data as a contiguous buffer from im->blocks[0].ptr without accounting for alignment padding between rows. Arrow support was introduced in commit 5c76e7ec17813eef (April 2025) as part of version 11.x series and is not present in the 10.4.0 br..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-25990 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-40192 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T17:25:21.803327+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 Version 10.4.0 is NOT affected by CVE-2026-42309. The CVE explicitly states the vulnerability was \"introduced in Pillow 11.2.1\" and version 10.4.0 predates this. The vulnerable code (recursive list processing in PyPath_Flatten) does not exist in 10.4.0. Target uses a macro-based implementation that cannot recursively process nested lists beyond one level, while the vulnerability was introduced ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-42311 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96638 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T12:11:30.249659+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 10.4.0.post16+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 10.4.0.post16+tuxcare of pillow, and is fixed in 10.4.0.post17+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-27T11:48:25.006252+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-29T22:40:38.548237+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 10.4.0.post16+tuxcare of pillow. not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 Target version 10.4.0.post17+tuxcare is NOT affected by GHSA-4fx9-vc88-q2xc. The infinite loop vulnerability in JpegImagePlugin was fixed in upstream commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray on 2022-01-01. This fix was already present in the upstream Pillow 10.4.0 release that TuxCare onboarded (4597 commits before first TuxCare commit 23be496a1). The vulnerable pattern ..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@10.4.0.post16+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@10.4.0.post16+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post16+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 10.4.0.post16+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T18:56:53.865914+00:00", "status_notes": "Vulnerability CVE-2022-29217 affects version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2022-29217" }, "action_statement": "Vulnerability CVE-2022-29217 affects version 2.10.1.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2025-45768 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2025-45768" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-101917 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-101917" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-101918 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-101918" }, "action_statement": "Vulnerability CVE-2026-101918 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102265 affects version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102265" }, "action_statement": "Vulnerability CVE-2026-102265 affects version 2.10.1.post5+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102266 affects version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102266" }, "action_statement": "Vulnerability CVE-2026-102266 affects version 2.10.1.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102267 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102267" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102268 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102268" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102269 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102269" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102270 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102270" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:35:00.185365+00:00", "status_notes": "Vulnerability CVE-2026-102271 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102271" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102272 affects version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102272" }, "action_statement": "Vulnerability CVE-2026-102272 affects version 2.10.1.post5+tuxcare of pyjwt." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-102273 affects version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102273" }, "action_statement": "Vulnerability CVE-2026-102273 affects version 2.10.1.post5+tuxcare of pyjwt." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-102274 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-102274" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-102275 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-102275" }, "action_statement": "Vulnerability CVE-2026-102275 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post6+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:36:58.215037+00:00", "status_notes": "Vulnerability CVE-2026-103001 does not affect version 2.10.1.post5+tuxcare of pyjwt. not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-103001" }, "impact_statement": "not_affected \u2014 Target version PyJWT 2.10.1 is NOT AFFECTED by CVE-2026-103001. The vulnerability (mutation of caller's options dict) was fixed upstream in April 2022 via PR #743 (commit 3d4d822). Version 2.10.1 was released in November 2024 with this fix present (line 132: `options = dict(options or {})`). The vulnerability was later reintroduced by PR #1045 in March 2025, affecting versions 2.11.0+ including..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-32597 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-32597" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-48522 does not affect version 2.10.1.post5+tuxcare of pyjwt. already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-48522" }, "impact_statement": "already_fixed \u2014 CVE-2026-48522 describes PyJWKClient accepting non-HTTP(S) URI schemes (file://, ftp://, data:) which enables SSRF and token forgery. The target repository at version 2.10.1.post2+tuxcare (SHA 098e78a) already contains the exact defense recommended in the CVE. The fix was backported by TuxCare in commit afaaa88 as part of the PyJWT 2.13.0 security bundle. The same vulnerability reporter (Keijo ..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-48523 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48523" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-48524 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48524" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-48525 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48525" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-01T07:31:00.118390+00:00", "status_notes": "Vulnerability CVE-2026-48526 is fixed in version 2.10.1.post5+tuxcare of pyjwt.", "vulnerability": { "name": "CVE-2026-48526" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pyjwt@2.10.1.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:32:00.646701+00:00", "status_notes": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare.", "vulnerability": { "name": "GHSA-pxh4-856f-4h89" }, "action_statement": "Vulnerability GHSA-pxh4-856f-4h89 affects version 2.10.1.post5+tuxcare of pyjwt, and is fixed in 2.10.1.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45115 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45115" }, "action_statement": "Vulnerability CVE-2021-45115 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2021-45116 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2021-45116" }, "action_statement": "Vulnerability CVE-2021-45116 affects version 3.2.25.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:05:47.206663+00:00", "status_notes": "Vulnerability CVE-2021-45452 does not affect version 3.2.25.post3+tuxcare of django. not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-45452" }, "impact_statement": "not_affected \u2014 The target (Django 3.2.25) is not affected by CVE-2021-45452. The upstream fix from Django 3.2.11 (commit 8d2f7cff76) was already present in the release that TuxCare onboarded. All three fix components are present in django/core/files/storage.py: (1) backslash normalization before path validation in get_available_name() and generate_filename(), (2) relative path enforcement via os.path.relpath(..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-29T19:54:52.451047+00:00", "status_notes": "Vulnerability CVE-2022-22818 does not affect version 3.2.25.post3+tuxcare of django. not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22818" }, "impact_statement": "not_affected \u2014 The target Django 3.2.25.post12+tuxcare is NOT affected by CVE-2022-22818. The vulnerability (unescaped output in the {% debug %} template tag leading to XSS) was fixed in upstream Django 3.2.12. The target version 3.2.25 already contains the complete fix from commit 1a1e8278c4, which HTML-escapes all debug output via the escape() function. This fix was authored by upstream Django developers an..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-23833 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-23833" }, "action_statement": "Vulnerability CVE-2022-23833 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28346 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28346" }, "action_statement": "Vulnerability CVE-2022-28346 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2022-28347 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-28347" }, "action_statement": "Vulnerability CVE-2022-28347 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-34265 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-34265" }, "action_statement": "Vulnerability CVE-2022-34265 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2022-36359 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-36359" }, "action_statement": "Vulnerability CVE-2022-36359 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2022-41323 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2022-41323" }, "action_statement": "Vulnerability CVE-2022-41323 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2023-23969 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-23969" }, "action_statement": "Vulnerability CVE-2023-23969 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2023-24580 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-24580" }, "action_statement": "Vulnerability CVE-2023-24580 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2023-31047 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-31047" }, "action_statement": "Vulnerability CVE-2023-31047 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2023-36053 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-36053" }, "action_statement": "Vulnerability CVE-2023-36053 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-41164 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-41164" }, "action_statement": "Vulnerability CVE-2023-41164 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-43665 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-43665" }, "action_statement": "Vulnerability CVE-2023-43665 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2023-46695 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2023-46695" }, "action_statement": "Vulnerability CVE-2023-46695 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2024-24680 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-24680" }, "action_statement": "Vulnerability CVE-2024-24680 affects version 3.2.25.post3+tuxcare of django." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-29T20:14:21.512222+00:00", "status_notes": "Vulnerability CVE-2024-27351 does not affect version 3.2.25.post3+tuxcare of django. not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-27351" }, "impact_statement": "not_affected \u2014 CVE-2024-27351 is not present in Django 3.2.25.post12+tuxcare. The vulnerable regular expression pattern that caused catastrophic backtracking has been replaced by a secure WordsRegex class implementation. This fix was authored by upstream Django maintainer Shai Berger (shai@platonix.com) in commit 072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 and was included in the upstream Django 3.2.25 release b..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-38875 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-38875" }, "action_statement": "Vulnerability CVE-2024-38875 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-39329 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39329" }, "action_statement": "Vulnerability CVE-2024-39329 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-39330 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39330" }, "action_statement": "Vulnerability CVE-2024-39330 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-39614 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-39614" }, "action_statement": "Vulnerability CVE-2024-39614 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2024-41989 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41989" }, "action_statement": "Vulnerability CVE-2024-41989 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-41990 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41990" }, "action_statement": "Vulnerability CVE-2024-41990 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-41991 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-41991" }, "action_statement": "Vulnerability CVE-2024-41991 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-42005 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-42005" }, "action_statement": "Vulnerability CVE-2024-42005 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2024-45230 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-45230" }, "action_statement": "Vulnerability CVE-2024-45230 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-45231 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare.", "vulnerability": { "name": "CVE-2024-45231" }, "action_statement": "Vulnerability CVE-2024-45231 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53907 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53907" }, "action_statement": "Vulnerability CVE-2024-53907 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2024-53908 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-53908" }, "action_statement": "Vulnerability CVE-2024-53908 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2024-56374 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2024-56374" }, "action_statement": "Vulnerability CVE-2024-56374 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-13372 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13372" }, "action_statement": "Vulnerability CVE-2025-13372 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2025-13473 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-13473" }, "action_statement": "Vulnerability CVE-2025-13473 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-14550 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-14550" }, "action_statement": "Vulnerability CVE-2025-14550 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-26699 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-26699" }, "action_statement": "Vulnerability CVE-2025-26699 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-27556 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-27556" }, "action_statement": "Vulnerability CVE-2025-27556 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2025-32873 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-32873" }, "action_statement": "Vulnerability CVE-2025-32873 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-48432 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare.", "vulnerability": { "name": "CVE-2025-48432" }, "action_statement": "Vulnerability CVE-2025-48432 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post5+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57833 is fixed in version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-57833" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2025-59681 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59681" }, "action_statement": "Vulnerability CVE-2025-59681 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2025-59682 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-59682" }, "action_statement": "Vulnerability CVE-2025-59682 affects version 3.2.25.post3+tuxcare of django." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64458 is fixed in version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64458" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64459 is fixed in version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64459" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-64460 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2025-64460" }, "action_statement": "Vulnerability CVE-2025-64460 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-1207 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1207" }, "action_statement": "Vulnerability CVE-2026-1207 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1285 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1285" }, "action_statement": "Vulnerability CVE-2026-1285 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-1287 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1287" }, "action_statement": "Vulnerability CVE-2026-1287 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-1312 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-1312" }, "action_statement": "Vulnerability CVE-2026-1312 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15307 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15307" }, "action_statement": "Vulnerability CVE-2026-15307 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-07T11:08:00.189086+00:00", "status_notes": "Vulnerability CVE-2026-15830 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-15830" }, "action_statement": "Vulnerability CVE-2026-15830 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-25673 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25673" }, "action_statement": "Vulnerability CVE-2026-25673 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-25674 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-25674" }, "action_statement": "Vulnerability CVE-2026-25674 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:07:12.211534+00:00", "status_notes": "Vulnerability CVE-2026-33033 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33033" }, "action_statement": "Vulnerability CVE-2026-33033 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-33034 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-33034" }, "action_statement": "Vulnerability CVE-2026-33034 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:09:04.720419+00:00", "status_notes": "Vulnerability CVE-2026-3902 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-3902" }, "action_statement": "Vulnerability CVE-2026-3902 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:08:06.540752+00:00", "status_notes": "Vulnerability CVE-2026-4277 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4277" }, "action_statement": "Vulnerability CVE-2026-4277 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:06:21.253116+00:00", "status_notes": "Vulnerability CVE-2026-4292 affects version 3.2.25.post3+tuxcare of django.", "vulnerability": { "name": "CVE-2026-4292" }, "action_statement": "Vulnerability CVE-2026-4292 affects version 3.2.25.post3+tuxcare of django." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-08T06:59:00.131978+00:00", "status_notes": "Vulnerability CVE-2026-48587 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-48587" }, "action_statement": "Vulnerability CVE-2026-48587 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-48588 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-48588" }, "action_statement": "Vulnerability CVE-2026-48588 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-53877 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-53877" }, "action_statement": "Vulnerability CVE-2026-53877 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-53878 does not affect version 3.2.25.post3+tuxcare of django. not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici...", "vulnerability": { "name": "CVE-2026-53878" }, "impact_statement": "not_affected \u2014 Django 3.2.25 is not affected by CVE-2026-53878. The CVE concerns `DomainNameValidator` (introduced in Django 5.x/6.x) which does not prohibit newlines in domain names. Django 3.2.25 lacks this class entirely. The existing domain validators (`_simple_domain_name_validator` in sites/models.py, `EmailValidator.validate_domain_part()` in core/validators.py) already prohibit newlines either explici..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-10-01T05:23:00.306633+00:00", "status_notes": "Vulnerability CVE-2026-6873 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-6873" }, "action_statement": "Vulnerability CVE-2026-6873 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/django@3.2.25.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/django@3.2.25.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-8404 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-8404" }, "action_statement": "Vulnerability CVE-2026-8404 affects version 3.2.25.post3+tuxcare of django, and is fixed in 3.2.25.post7+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post12+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post12+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post12+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post12+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post12+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post12+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post12+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post2+tuxcare.", "vulnerability": { "name": "CVE-2024-28219" }, "action_statement": "Vulnerability CVE-2024-28219 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post2+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post1+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post1+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post1+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post1+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post1+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post1+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post1+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post5+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post5+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post5+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post5+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post5+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post5+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post5+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post6+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post6+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post6+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post6+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post6+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post6+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post6+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:15:08.978693+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post7+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post7+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post7+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post7+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post7+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post7+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post7+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post10+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post10+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-23T11:47:08.832866+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post10+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post10+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post10+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post10+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post10+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post9+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post9+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-22T01:08:05.679640+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post9+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post9+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post9+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post9+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post9+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2023-44271" }, "action_statement": "Vulnerability CVE-2023-44271 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54058" }, "action_statement": "Vulnerability CVE-2026-54058 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54059" }, "action_statement": "Vulnerability CVE-2026-54059 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-54060" }, "action_statement": "Vulnerability CVE-2026-54060 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare.", "vulnerability": { "name": "CVE-2026-55379" }, "action_statement": "Vulnerability CVE-2026-55379 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post3+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post2+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post2+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post2+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post2+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post2+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post2+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112901" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post14+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post14+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post14+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post14+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post14+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post14+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post4+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post4+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post4+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post4+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post4+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post4+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T07:24:51.090949+00:00", "status_notes": "Vulnerability CVE-2023-32681 does not affect version 2.31.0.post4+tuxcare of requests. not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-32681" }, "impact_statement": "not_affected \u2014 The target (requests 2.31.0.post3+tuxcare) is NOT AFFECTED by CVE-2023-32681. The vulnerability pattern that leaked Proxy-Authorization headers to HTTPS destination servers is not present in the target code. The fix was shipped in the upstream requests v2.31.0 release (commit 74ea7cf7) authored by Nate Prewitt, which predates all TuxCare modifications to this version branch. The fix prevents ad..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T07:24:51.090949+00:00", "status_notes": "Vulnerability CVE-2024-35195 is fixed in version 2.31.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-35195" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T07:24:51.090949+00:00", "status_notes": "Vulnerability CVE-2024-47081 is fixed in version 2.31.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2024-47081" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/requests@2.31.0.post4+tuxcare", "identifiers": { "purl": "pkg:pypi/requests@2.31.0.post4+tuxcare" } } ], "timestamp": "2026-10-30T07:24:51.090949+00:00", "status_notes": "Vulnerability CVE-2026-25645 is fixed in version 2.31.0.post4+tuxcare of requests.", "vulnerability": { "name": "CVE-2026-25645" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-42308" }, "action_statement": "Vulnerability CVE-2026-42308 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42310 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare.", "vulnerability": { "name": "CVE-2026-42310" }, "action_statement": "Vulnerability CVE-2026-42310 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post5+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-55380" }, "action_statement": "Vulnerability CVE-2026-55380 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-55798 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare.", "vulnerability": { "name": "CVE-2026-55798" }, "action_statement": "Vulnerability CVE-2026-55798 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post4+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59197 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59197" }, "action_statement": "Vulnerability CVE-2026-59197 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59198" }, "action_statement": "Vulnerability CVE-2026-59198 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59199 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59199" }, "action_statement": "Vulnerability CVE-2026-59199 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T08:40:40.287998+00:00", "status_notes": "Vulnerability CVE-2026-59200 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare.", "vulnerability": { "name": "CVE-2026-59200" }, "action_statement": "Vulnerability CVE-2026-59200 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post6+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare.", "vulnerability": { "name": "CVE-2026-59204" }, "action_statement": "Vulnerability CVE-2026-59204 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post8+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-09-29T13:19:07.423599+00:00", "status_notes": "Vulnerability CVE-2026-59205 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare.", "vulnerability": { "name": "CVE-2026-59205" }, "action_statement": "Vulnerability CVE-2026-59205 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post7+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post3+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post3+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post3+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post3+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post3+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post3+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post3+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112390 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112390" }, "action_statement": "Vulnerability CVE-2026-112390 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112392 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112392" }, "action_statement": "Vulnerability CVE-2026-112392 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112393 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112393" }, "action_statement": "Vulnerability CVE-2026-112393 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112395 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112395" }, "action_statement": "Vulnerability CVE-2026-112395 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112397 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112397" }, "action_statement": "Vulnerability CVE-2026-112397 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112398" }, "action_statement": "Vulnerability CVE-2026-112398 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112399 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112399" }, "action_statement": "Vulnerability CVE-2026-112399 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112400 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112400" }, "action_statement": "Vulnerability CVE-2026-112400 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T20:51:16.968041+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112402 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112402" }, "action_statement": "Vulnerability CVE-2026-112402 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112403 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112403" }, "action_statement": "Vulnerability CVE-2026-112403 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112404 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112404" }, "action_statement": "Vulnerability CVE-2026-112404 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112406 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112406" }, "action_statement": "Vulnerability CVE-2026-112406 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112892 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112892" }, "action_statement": "Vulnerability CVE-2026-112892 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:48:00.116347+00:00", "status_notes": "Vulnerability CVE-2026-112894 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112894" }, "action_statement": "Vulnerability CVE-2026-112894 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112895 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112895" }, "action_statement": "Vulnerability CVE-2026-112895 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:13:13.161370+00:00", "status_notes": "Vulnerability CVE-2026-112896 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112896" }, "action_statement": "Vulnerability CVE-2026-112896 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112897 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112897" }, "action_statement": "Vulnerability CVE-2026-112897 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-21T14:14:00.257991+00:00", "status_notes": "Vulnerability CVE-2026-112899 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-112899" }, "action_statement": "Vulnerability CVE-2026-112899 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T11:47:20.125936+00:00", "status_notes": "Vulnerability CVE-2026-112900 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare.", "vulnerability": { "name": "CVE-2026-112900" }, "action_statement": "Vulnerability CVE-2026-112900 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post10+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T06:25:00.255950+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:51:00.078045+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-09-30T05:50:00.203197+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-23T07:52:59.498694+00:00", "status_notes": "Vulnerability CVE-2026-96640 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare.", "vulnerability": { "name": "CVE-2026-96640" }, "action_statement": "Vulnerability CVE-2026-96640 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post9+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-22T17:04:00.236273+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post8+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post8+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post8+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post8+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post8+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post8+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post8+tuxcare of pillow." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:35:03.049480+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:38:00.158348+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:16:24.474096+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112391" }, "action_statement": "Vulnerability CVE-2026-112391 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112394" }, "action_statement": "Vulnerability CVE-2026-112394 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T23:05:48.794673+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-27T10:34:00.136728+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:23:04.118629+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112891" }, "action_statement": "Vulnerability CVE-2026-112891 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112898" }, "action_statement": "Vulnerability CVE-2026-112898 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-112902" }, "action_statement": "Vulnerability CVE-2026-112902 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:26:00.164273+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T17:24:00.394999+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96636" }, "action_statement": "Vulnerability CVE-2026-96636 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96637 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96637" }, "action_statement": "Vulnerability CVE-2026-96637 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare.", "vulnerability": { "name": "CVE-2026-96641" }, "action_statement": "Vulnerability CVE-2026-96641 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post13+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96642 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96642" }, "action_statement": "Vulnerability CVE-2026-96642 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:03:44.920105+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T12:55:53.554317+00:00", "status_notes": "Vulnerability CVE-2026-96778 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare.", "vulnerability": { "name": "CVE-2026-96778" }, "action_statement": "Vulnerability CVE-2026-96778 affects version 9.5.0.post11+tuxcare of pillow, and is fixed in 9.5.0.post12+tuxcare." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-29T22:41:00.186117+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post11+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-26T10:39:23.241297+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post11+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post11+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post11+tuxcare" } } ], "timestamp": "2026-10-28T19:05:19.418788+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post11+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post11+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@23.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@23.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T07:17:44.348744+00:00", "status_notes": "Vulnerability CVE-2026-27448 is fixed in version 23.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27448" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pyopenssl@23.3.0.post2+tuxcare", "identifiers": { "purl": "pkg:pypi/pyopenssl@23.3.0.post2+tuxcare" } } ], "timestamp": "2026-10-30T07:17:44.348744+00:00", "status_notes": "Vulnerability CVE-2026-27459 is fixed in version 23.3.0.post2+tuxcare of pyopenssl.", "vulnerability": { "name": "CVE-2026-27459" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2022-22815 does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22815" }, "impact_statement": "not_affected \u2014 CVE-2022-22815 affects Pillow before 9.0.0 due to improper initialization in path_getbbox. The target (Pillow 9.5.0.post12+tuxcare) already contains both upstream fixes: (1) calloc instead of malloc for zero-initialized memory allocation (line 60 in src/path.c), and (2) bounds check for count==0 before array access (lines 312-315). These fixes were authored by Andrew Murray (radarhere@users.nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2022-22816 does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22816" }, "impact_statement": "not_affected \u2014 CVE-2022-22816 is NOT present in this target. The vulnerability was a buffer over-read in path_getbbox when ImagePath.Path was initialized with zero or insufficient coordinates. The target is Pillow version 9.5.0.post12+tuxcare, which contains both upstream fixes (commits c48271ab3 and 1e092419b) that shipped in Pillow 9.5.0, well after the vulnerable versions (before 9.0.0). The fixes initiali..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2022-22817 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-22817" }, "action_statement": "Vulnerability CVE-2022-22817 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2022-24303 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-24303" }, "action_statement": "Vulnerability CVE-2022-24303 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2022-45198 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2022-45198" }, "action_statement": "Vulnerability CVE-2022-45198 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2023-44271 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-44271" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2023-4863 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-4863" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2023-50447 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2023-50447" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2024-28219 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2024-28219" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2025-48379 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2025-48379" }, "action_statement": "Vulnerability CVE-2025-48379 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112390 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112390" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112391 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112391" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112392 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112392" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112393 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112393" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112394 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112394" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112395 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112395" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112396 does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro...", "vulnerability": { "name": "CVE-2026-112396" }, "impact_statement": "not_affected \u2014 Version 9.5.0 is NOT AFFECTED by CVE-2026-112396. The target implements a runtime defense that prevents the use-after-free: TIFFClose() is called before free(clientstate->data) in all three code paths where the buffer is freed (lines 971\u2192973 for TIFFWriteScanline errors, 988\u2192990 for TIFFFlush errors, and 995\u21921014 for successful completion). When TIFFClose executes, it flushes buffered data thro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112397 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112397" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112398 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112398" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112399 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112399" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112400 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112400" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112401 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112401" }, "action_statement": "Vulnerability CVE-2026-112401 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112402 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112402" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112403 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112403" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112404 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112404" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112405 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112405" }, "action_statement": "Vulnerability CVE-2026-112405 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112406 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112406" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112891 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112891" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112892 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112892" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112893 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112893" }, "action_statement": "Vulnerability CVE-2026-112893 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112894 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112894" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112895 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112895" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112896 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112896" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112897 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112897" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112898 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112898" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112899 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112899" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-112900 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112900" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T11:57:38.726923+00:00", "status_notes": "Vulnerability CVE-2026-112901 affects version 9.5.0.post13+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare.", "vulnerability": { "name": "CVE-2026-112901" }, "action_statement": "Vulnerability CVE-2026-112901 affects version 9.5.0.post13+tuxcare of pillow, and is fixed in 9.5.0.post14+tuxcare." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-112902 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-112902" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-114501 does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114501" }, "impact_statement": "not_affected \u2014 Target version 9.5.0 does not have Apache Arrow export functionality, which was introduced in later versions (11.x+). The vulnerability requires Arrow export methods (__arrow_c_array__, __arrow_c_schema__) and the underlying C implementation (Arrow.c) to export image data with non-contiguous rows. Since these components do not exist in version 9.5.0, the INPUT defined in the Attack Vector Brief..." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-25990 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-25990" }, "action_statement": "Vulnerability CVE-2026-25990 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-40192 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-40192" }, "action_statement": "Vulnerability CVE-2026-40192 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-42308 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42308" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-42309 does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42309" }, "impact_statement": "not_affected \u2014 The target version (Pillow 9.5.0.post12+tuxcare) does not have the CVE-2026-42309 vulnerability. The CVE explicitly states this vulnerability was \"introduced in Pillow 11.2.1\" when coordinate processing code was refactored from a non-recursive macro to a recursive function. Version 9.5.0 uses the older macro-based implementation in src/path.c that safely rejects deeply nested lists with an erro..." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-42310 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42310" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-42311 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-42311" }, "action_statement": "Vulnerability CVE-2026-42311 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-54058 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54058" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-54059 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54059" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-54060 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-54060" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-55379 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55379" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-55380 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55380" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-55798 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-55798" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59197 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59197" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59198 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59198" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59199 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59199" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59200 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59200" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59204 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59204" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-59205 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-59205" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96636 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96636" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96637 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96637" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96638 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96638" }, "action_statement": "Vulnerability CVE-2026-96638 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96639 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96639" }, "action_statement": "Vulnerability CVE-2026-96639 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96640 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96640" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T10:20:00.109102+00:00", "status_notes": "Vulnerability CVE-2026-96641 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96641" } }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96642 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96642" } }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96643 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96643" }, "action_statement": "Vulnerability CVE-2026-96643 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96644 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96644" }, "action_statement": "Vulnerability CVE-2026-96644 affects version 9.5.0.post13+tuxcare of pillow." }, { "status": "fixed", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability CVE-2026-96778 is fixed in version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "CVE-2026-96778" } }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability GHSA-4fx9-vc88-q2xc does not affect version 9.5.0.post13+tuxcare of pillow. not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4fx9-vc88-q2xc" }, "impact_statement": "not_affected \u2014 The target Pillow 9.5.0.post12+tuxcare is NOT AFFECTED by GHSA-4fx9-vc88-q2xc (infinite loop in JpegImagePlugin EOF handling). The vulnerability pattern\u2014repeated EOF marker injection without state tracking\u2014is not present in the target code. The upstream fix (commit 1059eb537639925c96d3245dcd73c106d4266c83 by Andrew Murray, dated 2022-01-01) was already included in the Pillow 9.5.0 release that ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability GHSA-56pw-mpj4-fxww is a false positive for pillow 9.5.0.post13+tuxcare.", "vulnerability": { "name": "GHSA-56pw-mpj4-fxww" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:pypi/pillow@9.5.0.post13+tuxcare", "identifiers": { "purl": "pkg:pypi/pillow@9.5.0.post13+tuxcare" } } ], "timestamp": "2026-10-30T08:29:41.128640+00:00", "status_notes": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post13+tuxcare of pillow.", "vulnerability": { "name": "GHSA-78g4-xqwv-q3g8" }, "action_statement": "Vulnerability GHSA-78g4-xqwv-q3g8 affects version 9.5.0.post13+tuxcare of pillow." } ], "@id": "urn:sha256:f64169c86731403bd982a259c9eced5ff6377411a1bcae952b8a969c3fa5f72e" }